From cd62c375a28c4be6e7437aa0c1e762956d34eb61 Mon Sep 17 00:00:00 2001 From: Ahmed Hassan <51206155+AAH20@users.noreply.github.com> Date: Sun, 16 Aug 2026 18:57:39 +0300 Subject: [PATCH 1/6] =?UTF-8?q?Add=20dual-signal=20Firepower=20analytic=20?= =?UTF-8?q?rules=20(SnortML=20=E2=89=A0=20signature=20TP)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Encode ML-only escalate vs signature/corroborated Gate/Prove dispositions so BlockIP playbooks do not treat SnortML GID 411 as classic signature true positives. --- ...oFirepower-IDS-Signature-HighPriority.yaml | 75 ++++++++++++++++ ...epower-Signature-And-ML-Corroboration.yaml | 86 +++++++++++++++++++ .../CiscoFirepower-SnortML-GID411-MLOnly.yaml | 59 +++++++++++++ .../Solution_Cisco Firepower EStreamer.json | 7 +- .../Cisco Firepower EStreamer/ReleaseNotes.md | 1 + 5 files changed, 227 insertions(+), 1 deletion(-) create mode 100644 Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml create mode 100644 Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml create mode 100644 Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml new file mode 100644 index 00000000000..b5551fed037 --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml @@ -0,0 +1,75 @@ +id: a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6 +name: Cisco Firepower - IDS signature high priority classification +description: | + 'Detects classic Cisco Firepower / Snort-family signature hits (Generator ID not equal to SnortML GID 411) + with high-priority classifications commonly associated with malware C2, privilege gain, or network trojans. + These events are stronger signature true-positive candidates than ML-only (GID 411) paths and may justify + gated remediation after analyst or policy review — prefer HITL Gate/Prove over ungated BlockIP automation. + Pair with "Cisco Firepower - SnortML GID 411 ML-only high alert" and "Cisco Firepower - Signature and ML corroboration".' +severity: High +status: Available +requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog +queryFrequency: 15m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +tactics: + - CommandAndControl + - Execution +relevantTechniques: + - T1071 + - T1203 +query: | + let HighPriorityClassifications = dynamic([ + "A Network Trojan was Detected", + "A Network Trojan was detected", + "Successful Administrator Privilege Gain", + "Successful User Privilege Gain", + "Attempted Administrator Privilege Gain", + "Attempted User Privilege Gain", + "Known malware command and control traffic", + "Malware Command and Control Activity Detected", + "Known malicious file or file based exploit", + "Known client side exploit attempt", + "Large Scale Information Leak" + ]); + CommonSecurityLog + | where DeviceVendor =~ "Cisco" + | where DeviceProduct has_any ("Firepower", "Secure Firewall", "FTD", "NGFW") + | extend Combined = strcat( + tostring(Message), " ", + tostring(AdditionalExtensions), " ", + tostring(Activity), " ", + tostring(DeviceEventClassID), " ", + tostring(column_ifexists("FlexString1", "")), " ", + tostring(column_ifexists("FlexString2", "")), " ", + tostring(column_ifexists("DeviceCustomString1", "")), " ", + tostring(column_ifexists("DeviceCustomString2", "")), " ", + tostring(column_ifexists("DeviceCustomString3", "")), " ", + tostring(DeviceAction) + ) + | where not(Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411") + | where not(Combined has_any ("SnortML", "snortml", "is_ml_only=true")) + | where Combined has_any (HighPriorityClassifications) + or Activity has_any (HighPriorityClassifications) + | extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP + | project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction, + DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity +entityMappings: + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: HostCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SrcIpCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DstIpCustomEntity +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml new file mode 100644 index 00000000000..7c52a532cc4 --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml @@ -0,0 +1,86 @@ +id: 511445a6-6f4c-4e6a-a655-76c25b66597b +name: Cisco Firepower - Signature and ML corroboration +description: | + 'Detects dual-signal corroboration on Cisco Firepower CEF: a classic high-priority IDS classification + (Generator ID not SnortML GID 411) co-occurring with an ML-only (GID 411 / SnortML) alert for the same + source and destination within a short window. + Signature + ML corroboration is a stronger remediation candidate than ML-only paths. + Prefer Gate/Prove HITL before BlockIP playbooks. Do not equate standalone ML confidence to signature TP.' +severity: High +status: Available +requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog +queryFrequency: 15m +queryPeriod: 30m +triggerOperator: gt +triggerThreshold: 0 +tactics: + - CommandAndControl + - Exfiltration +relevantTechniques: + - T1071 + - T1041 +query: | + let lookback = 30m; + let HighPriorityClassifications = dynamic([ + "A Network Trojan was Detected", + "A Network Trojan was detected", + "Successful Administrator Privilege Gain", + "Successful User Privilege Gain", + "Attempted Administrator Privilege Gain", + "Attempted User Privilege Gain", + "Known malware command and control traffic", + "Malware Command and Control Activity Detected", + "Large Scale Information Leak" + ]); + let Base = CommonSecurityLog + | where TimeGenerated > ago(lookback) + | where DeviceVendor =~ "Cisco" + | where DeviceProduct has_any ("Firepower", "Secure Firewall", "FTD", "NGFW") + | where isnotempty(SourceIP) and isnotempty(DestinationIP) + | extend Combined = strcat( + tostring(Message), " ", + tostring(AdditionalExtensions), " ", + tostring(Activity), " ", + tostring(DeviceEventClassID), " ", + tostring(column_ifexists("FlexString1", "")), " ", + tostring(column_ifexists("FlexString2", "")), " ", + tostring(column_ifexists("DeviceCustomString1", "")), " ", + tostring(column_ifexists("DeviceCustomString2", "")) + ) + | extend IsMlOnly = Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411" + or Combined has_any ("SnortML", "snortml", "is_ml_only") + | extend IsSignatureHigh = not(IsMlOnly) + and ( + Combined has_any (HighPriorityClassifications) + or Activity has_any (HighPriorityClassifications) + ); + let Signatures = Base + | where IsSignatureHigh + | project SigTime = TimeGenerated, SourceIP, DestinationIP, SigActivity = Activity, SigMessage = Message, DeviceName; + let MlOnly = Base + | where IsMlOnly + | project MlTime = TimeGenerated, SourceIP, DestinationIP, MlActivity = Activity, MlMessage = Message; + Signatures + | join kind=inner MlOnly on SourceIP, DestinationIP + | where abs(datetime_diff('minute', SigTime, MlTime)) <= 5 + | extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP + | project SigTime, MlTime, DeviceName, SourceIP, DestinationIP, SigActivity, MlActivity, SigMessage, MlMessage, + HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity +entityMappings: + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: HostCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SrcIpCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DstIpCustomEntity +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml new file mode 100644 index 00000000000..f6b6c51fdf1 --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml @@ -0,0 +1,59 @@ +id: bab70c8d-220e-46dc-aef2-1411eb43284e +name: Cisco Firepower - SnortML GID 411 ML-only high alert +description: | + 'Detects Cisco Firepower / Snort-family intrusion events generated by SnortML (Generator ID / GID 411). + SnortML scores are machine-learning probability signals and must not be treated as equivalent to a classic Snort signature true positive (typically GID 1). + High ML-only confidence should escalate for corroboration — not automatic containment via BlockIP playbooks. + Pair with "Cisco Firepower - IDS signature high priority classification" and "Cisco Firepower - Signature and ML corroboration". + Related portable encodings: OCSF is_ml_only (ocsf-schema#1732), SigmaHQ/sigma#6237, elastic/detection-rules#6662.' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog +queryFrequency: 15m +queryPeriod: 15m +triggerOperator: gt +triggerThreshold: 0 +tactics: + - CommandAndControl + - Exfiltration +relevantTechniques: + - T1071 + - T1041 +query: | + CommonSecurityLog + | where DeviceVendor =~ "Cisco" + | where DeviceProduct has_any ("Firepower", "Secure Firewall", "FTD", "NGFW") + | extend Combined = strcat( + tostring(Message), " ", + tostring(AdditionalExtensions), " ", + tostring(Activity), " ", + tostring(DeviceEventClassID), " ", + tostring(column_ifexists("FlexString1", "")), " ", + tostring(column_ifexists("FlexString2", "")), " ", + tostring(column_ifexists("DeviceCustomString1", "")), " ", + tostring(column_ifexists("DeviceCustomString2", "")), " ", + tostring(column_ifexists("DeviceCustomString3", "")) + ) + | where Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411" + or Combined has_any ("SnortML", "snortml", "is_ml_only") + | extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP + | project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction, + DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity +entityMappings: + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: HostCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SrcIpCustomEntity + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DstIpCustomEntity +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json index 70f2d4291d2..f0011d6e869 100644 --- a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json +++ b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json @@ -7,6 +7,11 @@ "Data Connectors/CiscoFirepowerEStreamerCollector.json", "Data Connectors/template_CiscoFirepowerEStreamerAMA.json" ], + "Analytic Rules": [ + "Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml", + "Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml", + "Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml" + ], "Playbooks": [ "Playbooks/CiscoFirepowerConnector/azuredeploy.json", "Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/azuredeploy.json", @@ -17,7 +22,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Cisco Firepower EStreamer", - "Version": "3.0.1", + "Version": "3.0.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md index b01525318d9..1d125673280 100644 --- a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md +++ b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------| +| 3.0.2 | 16-08-2026 | Added dual-signal Analytic Rules (SnortML GID 411 ≠ signature TP). | | 3.0.1 | 10-07-2024 | Deprecating data connectors. | | 3.0.0 | 26-09-2023 | Addition of new Cisco Firepower EStreamer AMA **Data Connector** | From c956ddb7db500ce523cf13ff6f321708c6a3b41d Mon Sep 17 00:00:00 2001 From: aah20 Date: Sun, 16 Aug 2026 19:24:16 +0300 Subject: [PATCH 2/6] Deny auto BlockIP on ML-only Firepower incidents (Gate/Prove). SnortML / GID 411 must not be treated as a signature true positive: NetworkGroup auto-contain cancels, Teams HITL warns and still requires analyst confirmation. Co-authored-by: Cursor --- .../Solution_Cisco Firepower EStreamer.json | 2 +- .../azuredeploy.json | 215 +++++++++++++++--- .../readme.md | 4 +- .../azuredeploy.json | 143 +++++++++++- .../CiscoFirepower-BlockIP-Teams/readme.md | 12 +- .../Playbooks/readme.md | 4 +- .../Cisco Firepower EStreamer/ReleaseNotes.md | 1 + 7 files changed, 334 insertions(+), 47 deletions(-) diff --git a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json index 70f2d4291d2..8f77123245b 100644 --- a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json +++ b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json @@ -17,7 +17,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Cisco Firepower EStreamer", - "Version": "3.0.1", + "Version": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json index b4b671b0268..c10977e0ea5 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json @@ -2,49 +2,63 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "title": "Block IP - Cisco Firepower", - "description": "This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry.", - "mainSteps": ["When a new Sentinel incident is created, this playbook gets triggered and performs below actions.", + "title": "Block IP - Cisco Firepower", + "description": "Blocks IPs in Cisco Firepower via a Network Group object, with a Gate/Prove pre-check that DENIES automatic BlockIP when the incident is ML-only (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not treated as a classic signature true positive. Signature or corroborated incidents still block.", + "mainSteps": [ + "When a new Sentinel incident is created, this playbook gets triggered and performs below actions.", + "0. Gate/Prove: if incident title/description indicates ML-only (SnortML, GID 411, is_ml_only) without corroboration, comment and cancel - do not call FMC BlockIP.", "1. For the IPs we check if they are already selected for the Network Group object", "2. For the IPs not already selected for the Network Group object, add it so it gets blocked", - "3. Comment is added to Microsoft Sentinel incident", - "![Microsoft Sentinel comment](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/Images/BlockFQDN-NetworkGroup-AzureSentinel-Comments.png)", - "** IP is added to Cisco Firepower Network Group object:**", - "![Cisco Firepower Network Group object](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/Images/BlockFQDN-NetworkGroup-CiscoFirepowerAdd.png)" + "3. Comment is added to Microsoft Sentinel incident" ], - "prerequisites": ["1. Cisco Firepower custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc pages.", + "prerequisites": [ + "1. Cisco Firepower custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc pages.", "2. In Cisco Firepower there needs to be a Network Group object. [Creating Network Objects](https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/reusable_objects.html#ariaid-title15)" ], "prerequisitesDeployTemplateFile": "../CustomConnector/azuredeploy.json", - "postDeployment": ["**a. Authorize connections**", - "Once deployment is complete, you will need to authorize each connection.", - "1. Click the Microsoft Sentinel connection resource", - "2. Click edit API connection", - "3. Click Authorize", - "4. Sign in", - "5. Click Save", - "6. Repeat steps for other connections such as Cisco Firepower (For authorizing the Cisco Firepower API connection, the username and password needs to be provided)", - "**b. Configurations in Sentinel**", - "1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.", - "2. Configure the automation rules to trigger this playbook" + "postDeployment": [ + "**a. Authorize connections**", + "Once deployment is complete, you will need to authorize each connection.", + "1. Click the Microsoft Sentinel connection resource", + "2. Click edit API connection", + "3. Click Authorize", + "4. Sign in", + "5. Click Save", + "6. Repeat steps for other connections such as Cisco Firepower (For authorizing the Cisco Firepower API connection, the username and password needs to be provided)", + "**b. Configurations in Sentinel**", + "1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.", + "2. Configure the automation rules to trigger this playbook", + "**c. Dual-signal / Gate-Prove**", + "Do not attach this playbook to ML-only analytics (SnortML GID 411). Pair with the dual-signal analytic rules in this solution. Attach auto-BlockIP only to signature-high or signature+ML corroboration incidents. ML-only must escalate, not contain." + ], + "lastUpdateTime": "2026-08-16T00:00:00.000Z", + "entities": [ + "Ip" + ], + "tags": [ + "Remediation" ], - "lastUpdateTime": "2022-07-20T00:00:00.000Z", - "entities": ["Ip"], - "tags": ["Remediation"], "support": { - "tier": "Microsoft" + "tier": "Microsoft" }, "author": { "name": "Lior Tamir" }, "releaseNotes": [ - { - "version": "1.0.0", - "title": "Block IP - Cisco Firepower", - "notes": [ - "Initial version" - ] - } + { + "version": "1.0.0", + "title": "Block IP - Cisco Firepower", + "notes": [ + "Initial version" + ] + }, + { + "version": "1.1.0", + "title": "Gate/Prove ML-only deny auto-contain", + "notes": [ + "Deny automatic BlockIP when incident context is ML-only (SnortML / GID 411). Signature and corroborated paths unchanged." + ] + } ] }, "parameters": { @@ -114,7 +128,7 @@ ], "tags": { "hidden-SentinelTemplateName": "BlockIP-CiscoFirepower", - "hidden-SentinelTemplateVersion": "1.0" + "hidden-SentinelTemplateVersion": "1.1" }, "identity": { "type": "SystemAssigned" @@ -152,7 +166,11 @@ }, "actions": { "Entities_-_Get_IPs": { - "runAfter": {}, + "runAfter": { + "Gate_Prove_ML_only_deny_auto_contain": [ + "Succeeded" + ] + }, "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", @@ -693,6 +711,137 @@ "method": "post", "path": "/api/fmc_platform/v1/auth/revokeaccess" } + }, + "Initialize_Dual_signal_context": { + "runAfter": {}, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "DualSignalContext", + "type": "string", + "value": "@{toLower(concat(coalesce(triggerBody()?['object']?['properties']?['title'], ''), ' ', coalesce(triggerBody()?['object']?['properties']?['description'], '')))}" + } + ] + }, + "description": "Concatenate incident title+description for dual-signal Gate/Prove (ML-only vs signature/corroborated)." + }, + "Gate_Prove_ML_only_deny_auto_contain": { + "actions": { + "Add_comment_to_incident_(V3):_ML_only_deny_auto_contain": { + "runAfter": {}, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Gate/Prove: ML-only - auto-contain DENIED
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Terminate:_ML_only_deny_auto_contain": { + "runAfter": { + "Add_comment_to_incident_(V3):_ML_only_deny_auto_contain": [ + "Succeeded" + ] + }, + "type": "Terminate", + "inputs": { + "runStatus": "Cancelled" + }, + "description": "Kill-switch: do not call FMC BlockIP / Network Group APIs on ML-only incidents." + } + }, + "runAfter": { + "Initialize_Dual_signal_context": [ + "Succeeded" + ] + }, + "else": { + "actions": {} + }, + "expression": { + "and": [ + { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "gid 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "snortml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "is_ml_only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "ml-only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:ml-only" + ] + } + ] + }, + { + "not": { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "is_corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "signature and ml" + ] + } + ] + } + } + ] + }, + "type": "If", + "description": "Gate/Prove: deny auto-contain when ML-only (GID 411 / SnortML). Signature or corroborated incidents continue to BlockIP." } }, "outputs": {} @@ -724,4 +873,4 @@ } } ] -} \ No newline at end of file +} diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md index 4e28a2bdd68..30e3b2442e9 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md @@ -5,6 +5,7 @@ This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry. When a new Sentinel incident is created, this playbook gets triggered and performs below actions. +0. **Gate/Prove:** if the incident title/description indicates **ML-only** (SnortML / GID 411 / `is_ml_only`) without signature or dual-signal corroboration, the playbook comments on the incident and **cancels** - it does **not** call FMC BlockIP. Machine-learning confidence is not treated as a classic signature true positive. 1. For the IPs we check if they are already selected for the Network Group object 2. For the IPs not already selected for the Network Group object, add it so it gets blocked 3. Comment is added to Microsoft Sentinel incident
@@ -48,4 +49,5 @@ Once deployment is complete, you will need to authorize each connection. ### b. Configurations in Sentinel 1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity. -2. Configure the automation rules to trigger this playbook \ No newline at end of file +2. Configure the automation rules to trigger this playbook +3. **Do not** attach this auto-contain playbook to ML-only analytics (SnortML GID 411). Attach it only to signature-high or signature+ML corroboration incidents. Use the Teams HITL playbook when an analyst must review an ML-only alert. \ No newline at end of file diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json index d7ab823d7a2..7a691bd2afd 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json @@ -3,8 +3,9 @@ "contentVersion": "1.0.0.0", "metadata": { "title": "Block IP - Take Action from Teams - Cisco Firepower", - "description": "This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry.", + "description": "HITL BlockIP via Teams Adaptive Card. Adds a Gate/Prove warning when the incident is ML-only (SnortML / GID 411 / is_ml_only). Analysts must not treat ML confidence as a signature true positive. Teams confirmation remains required before BlockIP.", "mainSteps": ["When a new Sentinel incident is created, this playbook gets triggered and performs below actions.", + "0. Gate/Prove: if incident title/description indicates ML-only without corroboration, add an incident comment warning. Do not auto-block; Teams HITL continues.", "1. For the IPs we check if they are already selected for the Network Group object", "2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depending on it's current status block it by adding it to the Network Group object or unblock it by removing it from the Network Group object", "![Teams Adaptive Card preview](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/Images/BlockIP-Teams-AdaptiveCard.png)", @@ -19,7 +20,7 @@ "2. In Cisco Firepower there needs to be a Network Group object. [Creating Network Objects](https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/reusable_objects.html#ariaid-title15)" ], "prerequisitesDeployTemplateFile": "../CustomConnector/azuredeploy.json", - "lastUpdateTime": "2022-07-20T00:00:00.000Z", + "lastUpdateTime": "2026-08-16T00:00:00.000Z", "entities": ["Ip"], "tags": ["Remediation", "Response from teams"], "postDeployment":["**a. Authorize connections**", @@ -39,7 +40,9 @@ "5. Save the Logic App", "**c. Configurations in Sentinel**", "1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.", - "2. Configure the automation rules to trigger this playbook" + "2. Configure the automation rules to trigger this playbook", + "**d. Dual-signal / Gate-Prove**", + "Prefer this HITL playbook for ML-only analytics (SnortML GID 411). Auto-BlockIP (NetworkGroup) must not be attached to ML-only incidents. Do not treat ML confidence as a signature true positive." ], "support": { "tier": "Microsoft" @@ -54,6 +57,13 @@ "notes": [ "Initial version" ] + }, + { + "version": "1.1.0", + "title": "Gate/Prove ML-only HITL warning", + "notes": [ + "Warn Teams operators when incident context is ML-only (SnortML / GID 411) before offering BlockIP. Does not auto-contain." + ] } ] }, @@ -139,7 +149,7 @@ "tags": { "LogicAppsCategory": "security", "hidden-SentinelTemplateName": "BlockIP-Firepower-Teams", - "hidden-SentinelTemplateVersion": "1.0" + "hidden-SentinelTemplateVersion": "1.1" }, "identity": { "type": "SystemAssigned" @@ -176,8 +186,131 @@ } }, "actions": { - "Entities_-_Get_IPs": { + "Initialize_Dual_signal_context": { "runAfter": {}, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "DualSignalContext", + "type": "string", + "value": "@{toLower(concat(coalesce(triggerBody()?['object']?['properties']?['title'], ''), ' ', coalesce(triggerBody()?['object']?['properties']?['description'], '')))}" + } + ] + }, + "description": "Concatenate incident title+description for dual-signal Gate/Prove warning on HITL BlockIP." + }, + "Gate_Prove_ML_only_HITL_warning": { + "actions": { + "Add_comment_to_incident_(V3):_ML_only_HITL_warning": { + "runAfter": {}, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Gate/Prove HITL warning: ML-only
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + }, + "runAfter": { + "Initialize_Dual_signal_context": [ + "Succeeded" + ] + }, + "else": { + "actions": {} + }, + "expression": { + "and": [ + { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "gid 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "snortml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "is_ml_only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "ml-only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:ml-only" + ] + } + ] + }, + { + "not": { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "is_corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "signature and ml" + ] + } + ] + } + } + ] + }, + "type": "If", + "description": "Gate/Prove: warn HITL operators when the incident is ML-only. Does not auto-block; Teams confirmation remains required." + }, + "Entities_-_Get_IPs": { + "runAfter": { + "Gate_Prove_ML_only_HITL_warning": [ + "Succeeded" + ] + }, "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md index 45644a222fa..940d47273c9 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md @@ -5,11 +5,12 @@ This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry. When a new Sentinel incident is created, this playbook gets triggered and performs below actions. -1. For the IPs we check if they are already selected for the Network Group object -2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depending on it's current status block it by adding it to the Network Group object or unblock it by removing it from the Network Group object +1. **Gate/Prove:** if the incident title/description indicates **ML-only** (SnortML / GID 411 / `is_ml_only`) without corroboration, an incident comment warns the operator. The playbook does **not** auto-block; Teams confirmation is still required. Do not treat ML confidence as a signature true positive. +2. For the IPs we check if they are already selected for the Network Group object +3. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depending on it's current status block it by adding it to the Network Group object or unblock it by removing it from the Network Group object ![Teams Adaptive Card preview](./Images/BlockIP-Teams-AdaptiveCard.png) -3. The chosen changes are applied to the Network Group object -4. Comment is added to Microsoft Sentinel incident +4. The chosen changes are applied to the Network Group object +5. Comment is added to Microsoft Sentinel incident ![Microsoft Sentinel comment](./Images/BlockIP-Teams-AzureSentinel-Comments.png) ** IP is added to Cisco Firepower Network Group object:** @@ -57,4 +58,5 @@ The Teams channel to which the adaptive card will be posted will need to be conf #### c. Configurations in Sentinel 1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity. -2. Configure the automation rules to trigger this playbook \ No newline at end of file +2. Configure the automation rules to trigger this playbook +3. Prefer this HITL playbook for ML-only analytics (SnortML GID 411). Do not attach the auto-contain NetworkGroup playbook to ML-only incidents. \ No newline at end of file diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md index fd922e6f434..c9664479b26 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md @@ -82,8 +82,8 @@ Custom connector should be deployed in the Resource Group where the playbooks th ## 2. Deploy the required playbook template (or create your own playbook from scratch) This integration offers 3 playbook templates that blocks IP in 3 different methods. Each one has it's own documentation and quick deployment button: * [Cisco Firepower - Add FQDN to a Network Group object](./CiscoFirepower-BlockFQDN-NetworkGroup#deployment-instructions) -* [Cisco Firepower - Add IP Addresses to a Network Group object](./CiscoFirepower-BlockIP-NetworkGroup#deployment-instructions) -* [Cisco Firepower - Add IP Addresses to a Network Group object with Teams](./CiscoFirepower-BlockIP-Teams#deployment-instructions) +* [Cisco Firepower - Add IP Addresses to a Network Group object](./CiscoFirepower-BlockIP-NetworkGroup#deployment-instructions) — auto-contain. **Gate/Prove:** denied when the incident is ML-only (SnortML / GID 411). Attach only to signature-high or corroborated analytics. +* [Cisco Firepower - Add IP Addresses to a Network Group object with Teams](./CiscoFirepower-BlockIP-Teams#deployment-instructions) — HITL. Warns on ML-only; analyst confirmation is still required before BlockIP. diff --git a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md index b01525318d9..a8c44a7c69d 100644 --- a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md +++ b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------| +| 3.0.3 | 16-08-2026 | Gate/Prove on BlockIP playbooks: deny auto-contain for ML-only (SnortML GID 411); Teams HITL warning. | | 3.0.1 | 10-07-2024 | Deprecating data connectors. | | 3.0.0 | 26-09-2023 | Addition of new Cisco Firepower EStreamer AMA **Data Connector** | From a1bda970c3d30c0375b92a9485f0ad47af2ae6ee Mon Sep 17 00:00:00 2001 From: Ahmed Hassan Date: Wed, 19 Aug 2026 23:07:25 +0300 Subject: [PATCH 3/6] Fix Azure Government deploy button link in Playbook READMEs aka.ms/deploytoazuregovbutton -> aka.ms/deploytoazuregovernbutton, per review comment. --- .../Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/readme.md | 2 +- .../Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md | 2 +- .../Playbooks/CiscoFirepower-BlockIP-Teams/readme.md | 2 +- .../Playbooks/CiscoFirepowerConnector/readme.md | 4 ++-- Solutions/Cisco Firepower EStreamer/Playbooks/readme.md | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/readme.md index 9e24f8714ac..3d09c73ab79 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/readme.md @@ -32,7 +32,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor 1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockFQDN-NetworkGroup%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockFQDN-NetworkGroup%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockFQDN-NetworkGroup%2Fazuredeploy.json) 2. Fill in the required parameters: * Playbook Name: Enter the playbook name here (ex:CiscoFirepower-BlockFQDN-NetworkGroup) diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md index 30e3b2442e9..c47a45ce331 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md @@ -30,7 +30,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor 1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-NetworkGroup%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-NetworkGroup%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-NetworkGroup%2Fazuredeploy.json) 2. Fill in the required parameters: * Playbook Name: Enter the playbook name here (ex:CiscoFirepower-BlockIP-NetworkGroup) diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md index 940d47273c9..97b8acaebf1 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md @@ -31,7 +31,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor 1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-Teams%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-Teams%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCiscoFirepower-BlockIP-Teams%2Fazuredeploy.json) 2. Fill in the required parameters: * Playbook Name: Enter the playbook name here (ex:CiscoFirepower-BlockIP-Teams) diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepowerConnector/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepowerConnector/readme.md index 1289f756457..60ae56f27c2 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepowerConnector/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepowerConnector/readme.md @@ -60,7 +60,7 @@ Prior using this custom connector, it should be deployed in the Resource Group w [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) ### Connector via on-premises data gateway 1. Deploy the Custom Connector by clicking on "Deploy to Azure" button. This will take you to deplyoing an ARM Template wizard. @@ -69,7 +69,7 @@ Prior using this custom connector, it should be deployed in the Resource Group w * Service Endpoint: The URL to the Cisco Firepower REST API [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md index 320b250d18d..6bc6ceff357 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md @@ -66,7 +66,7 @@ Custom connector should be deployed in the Resource Group where the playbooks th [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy.json) ### Connector via on-premises data gateway 1. Deploy the Custom Connector by clicking on "Deploy to Azure" button. This will take you to deplyoing an ARM Template wizard. @@ -75,7 +75,7 @@ Custom connector should be deployed in the Resource Group where the playbooks th * Service Endpoint: The URL to the Cisco Firepower REST API [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy-gateway.json) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy-gateway.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FCisco%2520Firepower%2520EStreamer%2FPlaybooks%2FCustomConnector%2Fazuredeploy-gateway.json)

From e9ef6dd5bc7200bdbe09ebd8ff7ab6271639c4e2 Mon Sep 17 00:00:00 2001 From: aah20 Date: Tue, 25 Aug 2026 03:29:33 +0300 Subject: [PATCH 4/6] Repackage solution to 3.0.4 for dual-signal Firepower changes Ran Create-Azure-Sentinel-Solution V3 against Solutions/Cisco Firepower EStreamer/Data per review request, so mainTemplate.json and createUiDefinition.json reflect the 3.0.3 analytic rules and Gate/Prove BlockIP playbook changes. Version bumped 3.0.3 -> 3.0.4 (local mode, patch), matching ReleaseNotes.md. --- .../Solution_Cisco Firepower EStreamer.json | 6 +- .../Package/3.0.4.zip | Bin 0 -> 45428 bytes .../Package/createUiDefinition.json | 79 +- .../Package/mainTemplate.json | 771 +++++++++++++++++- .../Cisco Firepower EStreamer/ReleaseNotes.md | 1 + 5 files changed, 826 insertions(+), 31 deletions(-) create mode 100644 Solutions/Cisco Firepower EStreamer/Package/3.0.4.zip diff --git a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json index 42fe2fdc932..161f3b615e9 100644 --- a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json +++ b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json @@ -5,7 +5,7 @@ "Description": "The [Cisco Firepower](https://www.cisco.com/site/in/en/products/security/firewalls/index.html) eStreamer Solution for Microsoft Sentinel works with [Cisco Event Streamer](https://github.com/CiscoSecurity/fp-05-microsoft-sentinel-connector) (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel \r\n eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Data Connectors": [ "Data Connectors/CiscoFirepowerEStreamerCollector.json", - "Data Connectors/template_CiscoFirepowerEStreamerAMA.json" + "Data Connectors/template_CiscoFirepowerEStreamerAMA.json" ], "Analytic Rules": [ "Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml", @@ -20,9 +20,9 @@ ], "dependentDomainSolutionIds": [ "azuresentinel.azure-sentinel-solution-commoneventformat" - ], + ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Cisco Firepower EStreamer", - "Version": "3.0.3", + "Version": "3.0.4", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Cisco Firepower EStreamer/Package/3.0.4.zip b/Solutions/Cisco Firepower EStreamer/Package/3.0.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..7d2e8d6949a0063bd816f6d985233ff237a895c5 GIT binary patch literal 45428 zcmV)HK)t_EO9KQH0000804Ez6T~}MtB zX>V>WYIARH?OOeA+sG0BKTokxT3AX&$#(9N!f5WG`Xe!5UtG(*ps<2qMXsbxNG^}N zvZ6~3^jZ37eUkoWmt0X4paVw0SmozLIQ?E1q4##(>S;Y=jFb--FPV={fv z@4Gj>gr|He5|Nr7|9PH^UZ|4do9^%S_Imq4mWvxH7X8Cqa3lVHdL$+?l}4(xcRr7e z{4wdh)hd11>e5y-o<_0AX{&P?=1QxH=?yIF3Ij)bBXSKkM7y??`3;UUr*EdC7F)>3 z%&^1LZ?pG!oC!Id8UOs^Db9{r$;yN z_&Y?U?(0H;QUPtL9dU(x-8o?VzOzw9!Uj(*tJ!Lc~w@TEEbEN zb*jq>X+&S9eUbLFTt)NHkd)y(muA_YVD$owH7FwSzBe;T++m_LiI)!E%$ZLNR+^bD zRQ^sQR?MuF=lBNSSjnK#VU}>{MaY8PZ-b=d9h4Rf5XGqojmkT$jTBML8J_Evd>w|g zWt;*{v!$Ao*|hz}hD-Q9f#FO(*VeufZHwGp+C>F-(kuhFoVOMh(!q3P|%hQh8g9Eos}KoXwD8}X>B8NNWlgdr(mJwGzBj*FU5V$r|gI4 zC$GE{dK8EirlI4Pi=Pl&MuQuID+V`VePGpsdSfx;@r0>~-C=lod`?;*-=`FZKGS6C zBv46$C+Ef!l_%V=_TlkK#|9oGfGVpsv}q;~Iv`ft8TbW+Ol1NP?ePh_k(>?A2h6*h zEE)nl@L-7`sdlOpxo5SIaZLGGqz2SRWB`1P({xQtN5ZWU3*>rvb$q}cJzBXg7l=(b zJko3Q#H}jkVJT+ejrUR;QpbxAPa|RZSj`P-0tsOvFh>oE*m%hX^C^40*Jb;=``;A8 z9FeCyV@-&<--U34l*daWLv}fjg?;^)ULVf2L9klHW593_46;nuIP4MWMa-9DrQW&4 zwA=NW;Cadt<%Qgg-VIc!_u7G*EfD0Jz==ee3^b;&J)9~Y^FkHG8- zmj~6K1(-imZ53#UiJ770Ko;Z0OvRCF z`iIsjDALXQ);u3!yNH?*TZCfrwMyek7*wJ_e_9xzeL;aVx-msW^dpbqX6v?uXKfdP zZI=w~o%Mj<>GW=hyvqu@4tw@pS%P)js59y@if{0Dr_0KBjUm?oK^xsxdYSAuY zXXnGn*?ZJF7`1k~jL7V&F54Nkx}%nrr1|UZ4p_fl4^9eabV1Pu7*wpaf}IM9i>=oM zN}vbKJ^~Vin5*L57(li9T%{SuJQ7#ZSTXJ*gtw^@)k{|msGEh_3ygSg>J?;bGF*Z9 zuR!>B^%W{}HLzYEh#75AhWD`6IB6Tdwx3*eY1FdT+f_eH_1HhqjfXt7#bqm5(JYp; z04kx|1sQ{Ge*45h(cNQ%3H9Y$#>y^pLpSwE)bERwBUW5vSknafy&6`ha~bh8q`tBk z0#-~X8zu+AZ*_Qm<)T3FKraZh`sck`IS8Wd@$F#`FBkNhcQH1-> z0KtSO5?cEcPJni|LtF_jx$5ho-U zN1h~{pr)9M?2#`W_F4CwUa+h@Lc?wsT;}eyd(;qjr$@tz>^9o6Tq|h8KpKK$e_U%gF*_c z81}(y6-pbuc3HyX1p&(8ewW;FBV&OoKSdsP>5?K9hQ|wX*y1 z*DU#WD*0tI`tkoZqa!3@;A(8GqTyfNGKa?}2bKD|o}~ndwYrpUW_~^4v1y<}%=I}H zejBq5Sycke`B}$BsK4UWFy|;OjzY;>k)UILUR>&7jz^+V{l*%M6_Hv{590m%rw#AA z%ThpPW^QrkzS#hx6oeTtBcRe zuumF{y{wIc@kP_uUpN>y?etlLaiegbHW+)EeiMUnsnBW?rofnqIAano+#eU%)3EZG zjJ?d!sL>688;l3OMA$^R6gq=AXoQC^2bUeD{7vUaM{HxuW_e{Ei7Zx2)S`JBVU-v3 z$_rXtSyTkD&a#vE#?hU<318YnK`{5Hb5T)J-Cs-i+r_3yp7{ns% zdmij_8x4`4>`Se`(rmv8L-uER(W2%io3Gtkt#0sw%7u07dLnae+Q0Df3K7-*j0>!; zZDV!0!rnlY+b>o-*KWG(ZB?m5^`@$|rdavVu2QV76N#i@ui{#ita@ z6aWAK2mmJ=8C^24sekUI004R`1^^KN003=aX>L?yZE$R1bY(7Tb8l|!eQ8_jNVn+s z_gCcF=ecStG77rS+x<2IB8q?vqVByPPe=-gh6FNz*r)Grzg3li%oE_SO}d|MOln-U z)~YpD{rxY3*!eG!8iNVB^NrXUOVU*QmP{&djwU2Wj=%(P(h>P83*d<2C+asbnMtKj z6RBJxl}^%N%JNH8t_vnpmXyHJlgM+w?Hr=^DV~$yr&}P149}r%(nl%ukMel}B$6g2 z)c@b`Z}^6kr7TWv|C1ZJuZXQ#nSge(I3kQm4k z!2v)6nvi&6N{S*u3X_B+Jwq6X67fHEwTnb&%*!mDfK?M`AaOwoG{wVe|8qnTeLygr zC;^g2trF505dX8_g=cX}QXruX@_&fMn4!i5BN8+am^tinDDV?pyj~>q3Onks|H1$N zM_nd+dqLo8gcG7bM0$=5gZ&LM*KQIB8nWzE+vK%;pzba5Z4SP z@FG8yhz_J0h65~GP!UM-)G`O1IOe3lkOLMNXyZ|XUjz1~lcXb!9a?G_2tEtRJ*O4W zzSn5J#+1=OZYe!~EJU3)UH9D=2S|7B1%$DND z<_(_=?W0wK?>UGryiig&T)@6Osv7%sDdsi?tp)G`3nI9;ReZ0}d&27Hu8tN*%_$Ht zT9a%I))`?z<5AJ z+lx9=Kq2f+8ySVm+zxk>9#h*r^sAkqsl@J~%rP?=D8#)NZ2J2ylTe8$t#6yoU{d$k zmcY|8rDKyiT8VrHrePQ<=I}U$#=U#EOH;e}2cZnVqYPhd!?ilDS~iYFX(iCKmHyn; zR-3ySJS%$4cu-pr3N&`&&bSkI#+SH*cIQ#spT1p(p|$WC={w^^-`;@nfQXg8Gar?{ zGye3Q2}$3XPe9+9fb?wv52?yAZJ7nl!4oW*HVRe7&sOG`UP)4q#&VQtlO2$QLW(+} z6PZj3ByxGUq$C(-66stz4FXv=tc=E@v=VGeN{71`*_8R2)Bro~W_)lr6Bu`K zNit2Hf>b7-I2{ZMi5!*7B*-k8PMlryokss!$L=NQ11erfRP89M~=6I0LADW_eUK3Z*W^46><) zB9+NhS{4O?T;ev6A#`u|`%gnjSZq1q`DcsxV*Tu8Rj|*)xt4JX_7VF*+4|q1>{8Zz(wV|4;kr=1fU;W)}3&2euR??JXq(do)nXFq?p{s zC?*$#VsamlVsZf~Cih_}Cg)Ev)=6spStl7`j$-sVYSA6`Ioiq+PG8l@sdLla+j;~5 zoXvMUVOv;2Q13}{D)4iLhW#W}Q0cY?g8^a67<}NFR3@v$%Os`(m@{CpD#@wNbyqit zO)WE7Dhz=ZJKr4%Ah8NzFw~>L6mYcI6+pwTq79>1bTwfU{5RqMA(jWzg# z*GJyVRi`D}={mmJYsDlwnEs5d?E~Im-Q+dEL;uzQ>1uf+aWPeQx&osZluwHe? zhy+QLSO)e)bbtT}oG7+x1gyu5I28N_c>s!ivktgXJ?|6RUUfutVUbm%l+vC6u(*LD z=_Hb2VQXNH-eVR6xyS&FNp?u^L)=5BR=Fl%Z!A9=!QFBdyvA_K2>8ha{#C(Eob$qj zl!(1j<$V9hdFms9oQ`i~h!+lIsXb0BjcY?hgb1Ytesy_?WR-ElB?Kre(6Liol?8C! zXor9aEv^d=+P(IG6agAFwxB9=*2o_UpFg<&RYTm$kXk8l3wwev`{NJdhtk`R9cvL) zj#0|!gZZ(u<2ZtU9NzwPgs(_KRtzEo*s>v^fh|auC9rT0Q3bEFon`3tXKw)`!d$F~ z<0FaxgGv=yr~tS^(RtXxfx!aenq(Iw?D}H?0)b!-o7YNM2f8JQG-YYP%N$Mg!GP!r z5uFPrQgSU~Q zgaTsPDi?ecPKC;e@?-*c-d8|$nF%2NASUF?9{P#5ezd9XubN{-jz==9w8TaB*IfWr zM!<+)g7bqckBqPwnjlpZRhdYGpDVcMYWTEsN4Ut_0lp5`9=5M7z3Uo4i3@qq3BxpD zS!?Y-339~mWmB}v>cF*FbJfT>6gtQO!$P>Y2z6*1lSoNMiEZ0E{BRWVtp|nXn!$x&YLhsUy zFU0o_P_lApo|2KSucW2GR#-p^95LZxaS}=alA#II^3OfZtN?3@M=N(XvL;}=g7V)4 zzGVZ zs`wNQ@f_bfF=c1&hmx%X84sZ&f$91x0z_H~X$Xkf4MF`WED;MGLE2-2{<7O2c_z z*g#^WAjLusPO9LWkklAX&;tkUOXAm<0w0HLEDRWwhDVARB#?w&mJm|X0su}~I8ha8 zR)zqyKn`t5V@A|Fq)22}K-LA^2+twA)`S4uoDp~qv6Vxjh`0e7G!MH*)(T#x#UnQ{ z#DfI~hkJ(5uos&$D(4!KqET=LB#yEQ#->;BxmLIxGNoWck`5E|3fZYiUpvTo8Bv1k zp^gyBa)?%hB{4<%jgek-B7&80Cr)dwVY^~3G6O;VCF0k5Yp`S7RpvO8$rIgDOQpW_ z5!5=LAtfneCNZrOV{#6N)>0btoIY7?GO~yOfo3t}k>-y6LP@o765oiaQYWFBx7AKE zN5nmBbs~$B(lkW&Ig)ZsyWE~A)BL`*Kd=45%p1Mw+7HKYYYut6p5=#-`1%Y^3{qn?7_U$`D$uuiJvZ!WxI}{?ODrB zWrBtyY*CBQBgiz78D7~&6=1YA-UlM;<3+oZN5CiPt5WWJC}l2azBcm4>t z66|vILK&Tge!31IR#DH7xzy>=SemdNCZCN;AQ>oul=%h6@+55mqfQNq7^RR@sD04X zF!o1Fy2ny=GT2sa<>^GL<*;jgM|P6c3Ms?F%Y%(69equviPUjIS3VM=+CW0@VgHCA zYD2tJK{WwyQOd5QP5;hBxYA>$#mkkI$87TOaG|6!KOo{0X zF+?`w)po2f$=hq9HYJKQEx@fm)S_FPr;xL6$RIzPp%?5gqlj8dLj>3%CPI!v$3htJ zLgt_*huDk+CW$|5keiPbib?#bFNcA&8E%Mm3WQ@*sHlnnQ~8G@@ZTQ0JawEYq;jXZ z+?LloOAuW|dnJR}RF~~dYpyyT@dl2l^STsn?ct84EUy8z^y4~UYe+0Gb*Qg7>QYdp z3Ct**Dag4w0qecLSMNK_20xh?yYQQ3-;*6yoSiS)#6xC0Xrymn5 zvZ?K2MUE)x8>j+dY$3wqRn%v7u}D|9w>utqH;jDhP!7Iuk zF$n%#66!G~hr}4deU2!fq-jPmqG8oUF&ikIVO}oq5)b7~5u=ALGSGw)Z-k0yssg9P z{jL<>dv z*~OqJteM?ax5{eEv%CD%s4J}9)+DH^LgtCIXvL_SNf8i(Wytd29tfEsZp6Uu6dV_I zGY`8nq^cRFXExD9>}t7n6i7Aqf~luU9#$P+ zgDYl_h+A!0R)oG4E@+@&-r3x^E3P&|l7d_r@0A*#;e`>&F|SG_plIAOp;*8CfywxL zedQK9^~Y6JfCCN4$v|ms%NKU zhiT}?b~;YOG{9gDit-ex7r|O|2|QK;09vFVac(eR8SdE_m~Ynt9vLpF4kig#1H53N z-C+{m{LS#!iZ>c24#^VdJ6yT1xK_j^z~7z$^V6ZS=A3t|i9R}4^TiTF6_pG-SlYH6 z1etOu7?obN`d2>Wx6)^$cD1* zv{AC4KHkpinkwbpkVA4()LbpMq^4hPD_@%>_-);5Y}w9Rwf7bsa%&E~B^x&o$1T`x z>orz%-fBIzSkJ9>16%4po($@p63Bulj%^`fEHdYCPY`ouDt-xJo6YF*%jEik8C>3( zTQ=1=e5O{k46XOd%rc42X4G)a3vtalT{92lm&pHc2WYT74_D)iZ(fH-KF2SZ$MG{D z)V&i4ZP1RGIQTIW2L0@Q5fTGGctT*v8HY;z`I&ZDT{L=A97~X978ZH&_PH<}uDY z)5qI1`_q+s_-63$q;~XXbpZj2s6~i62}yl6ezn+rH%#|xm822n`;GeBGv%&ld7{5qK)&L<)TR3}4lr63s`A-T|p&eRB*q2ca% z^FPe_U)Dx89xnPWhv#SF!}H_A^EYyMe&$y`JUbqf9Ye}r;r)vmRG9{2-G=p#X;i2ubK9MsAoJRb+kM{+_Ee;{Xx zJmDUhA$Vcn((Ub*H1Ej;)Vpy~(c$jy{;C^8e4?SHwU4QePvnnJ1*3^*ewk2kNA2xD5;+k6D7LS$7rKS^=gt_g?BVKXU%@i_8#w60QoW{q zU;Tt1T=&K(T*2mPcZ>Q~jXD^BYA~Gk%4}~Hl@%BO1JoS>jVag>(ptn(Qf)Lrfnfql zAHPA`;1Y0^SD{FWDTFzuNF~x5f2AqG9Z1d?9C-g;|3ZzoKatKD&WO$_VVA12P>D%F z)3E!Q%&Y2mJX~O~1e>09;HXWacw`7I@ieTtpk|PB=Pd;B*nm>-w*(Hy)&1luBZ7#{ za|o7*6)9n&nAF8b7O~S3!LoSl|}+@RU^L1I@E7vtS=PBqa^jH5?uz0OZDonhY>SNlzG#naC3& zeUvE}qcbsY!qK@QnN47}uDE&>uC9DX0YW58?5n$q8u74#9W75;CDIU0ofJ{v4-Ok5 zQK%+jp=t?giBTqZL}<=@&4sUu5qb^`!b4}|CJ-mIld)s2MUeYV?1YVp+Wleyby<1>AhYC1G1SSf6Eje)p;!?23n)#dKMP(40oN z>R}u4Js&y`UEUY;D%5nVyW?hBI@ZDgRRh(V5_3SFo z7{#EgzKtxZID2Z_*;5-?`fX-O#o1BsmmRec*2=kbI&ocZ za_sU^lMP4~ErMu}70}OVNRd;ChuBj?yP%>}E5jxrF%giO_M!Z$6%movq6o0+4v@g^09Cyks9`Du z3fP4@8dd=yq^`K@6 z<7)6q|os2;4UB@5s>(?2MO<>G(hGIRcnP1BQb>!@m1~u944=MhVZyZS>lmC zNTJHer;n%+E5@iVNC!sRJ(3H=Z$z`yIfqK}M)`3p5M}iYz8uL*u{jrxJioW|G(uk*}@@|?V&))P>>}_ie8ft5ZnAMpU-C;0~##3 zR}K?V(MH82eUUI+NJRHe&8jvAEpEx7MED4<|K}gUH6}&KJRrDCaa@P6qAK`kL4?Z7 z^KM!BfuhfU?Chgv)d)>EssY2{Ku9Q0qJ#z|z*XYmpKy)#u7N1R-C-Y9hyNa0J{NU6 zN=4huMc1;bX5#i;nIraQmJt5c%5EjCk)&{nEO_bQk7;G9aGFtSXCl;A#$Cc;Ceg=W zZ)G!M$*x*Kwf9#zrLR5YD3Ici^K}GXh`)a9?EQz?-}}$E5kvp)NMp3$fBX<16F>jM z(EI4;w?BUV4(Vj?KmX^)4|*S=DjFFttXhRg3j19Vw-KEoFWa*hT=5P-o6!^n2rHAS zKn)NDXQ~u|2pX~ofvQa{-#dyJ**YZ3qGbDO2z9KrP)AyDuqkf%(A>+aMPuzlYux0a z9z%L)3Y%3|&yMDYgi2+HgcCg-+NSR?V~1(}aI$YH4Cx%_m~a&4Os#JE_}aB-3&2f* z_ADnNo2nA>xpNI@MxHp9lBZMTCxTNdtMLwMs~0}SE52M7V)|$V1Vv52X=poDynhSb zG3f{fwMKU=APWME8c#WmLW^15DJrq8tY>JO*}&mqE^>*-@xOk?DQG|3C9k?eQAzSE zfngD<1Wv{W+dGFQcO(?2N4X6c4;G3AMUF;UZ353aC%;!-h72pI7!j;rK#e&DWl6bp z-A$(oY3J_Xr(8N%KLFFwH94IkaV6Yx4jI7GK2_bT<0g=Bh!Vx z$2iLetLblemXB^YLPiDmqX+!$Ff}^8#_2wRFW0pgx}12n`JjQYlL&W2&zhDRgXP7v z5Ft+OiE1HJTa6F$i4XF@BZ&|4*#K2r&-QU6>J8hMd{6iZJ|Vq{w9lbGYd5(8e)jp@ zX&E1PS|)an+uY{e^vMRxH$x6#BJ&Y8h9ap83UnYMMjJ$G2wm z_P|bt@eL#m|D6N$f>ILrCz3;stL_+xKyv`1nj-whjo^&T&bEZ^Y@ctt=GoQR7Y=aL`(h}DmqjIF8D-(1|D#iyXac;z&5V(3mDF>sL@11DWe8H4qM>Y^ z6yOXyaJvRX%@Fup2jnyI9sS(@?;l+3MUB0v@9ahOguCMDvwB)h?#@kkTix0=ptQQ3 zDB~8<9}^XkjV{@JCx5WsiU&*H*B!n((+F5CcItjQr!HF1*rgl0bVImw;dI{2pPNZ# zV}GvUiT$~;Ki9QF?9crg{#>gKutsOz!JnI1&!6isiFN(Cp{#^k@#hA!&Z@1({@mD~ zi$@asb2mWMoAc*JGL1&?>$**BbsbA+zi!ATH^A3Ezh5`&xq)lq49-%yH-q8D`tOf-)`2Gzh{4O-!3haY(hy=w4?;Wf35pcsdE0!kf3Px*P<=U zlGw-DeZW@NFYGkIQ*dFCm0KY!2mh+(YQC=TE51toP-GFp=?AA^6?Qh!E5j;oj^W^l z#W6~yRL(0#Nu2u5dSG*ADtE8w9$};FR`&v%oxs@ji~O&O=~3q znb+Oo5^_Sr=1G?4fHEdMdlMb%qYt>-ikN`t>A~HAf0c!E8bB6K{6S<>lmGs~#ZK1` z?{p316GiKIhR%li!+u!M%DZFofvC4!XehD&zFt(@Z6BIbMmb~E@WJGxi9N8N&I7Ca zMb%}iiPtPT|3X3Cx6ek^hoN&{oT2{*_Nr=wQ(c`16~j4O_YF1oRu>0F@w2Ma3F~V` z)if5NPZ4o;#4lE)XPH0xu)1FdenPzC5Bse;I5%G#(jVv$GBhS5eZcQ3;jKQeC~@V7 zU431>Q-_aEeF*5I{lh?lrVp?$H1acs`vXFL&*BbFPc#te$Y=$R`oReWTvL}<5WHqx z0eH=N!ta`O1>f63XN5dyYEL{A+K|Zn2R?9EgBv=b%Xu&>Sds&A4@qbe?B$VWhQqyG z<-EGxLk-goRe-X#|WnFp!cFEsQi|zz3BN zf0P)4Y$}c+h+_z}=Hj$)A`T;n!wBLq0*7hEVFaHmjKFGcuF=_d2qVa@7e?SPiFLyW zLK&pD5=Icr5ummjhY`eK1b8HI7{LapdV^`O?qc@Qa9Xb%Q$qn$b&lWnM zd5>)8D4SgUafkr1c8I|00;-k@^Iym9uVImPG=kNk>~)vGjv|Na;8B^6!{P4uQj}Zm z5&#$I+J!ug>J)3D{ktv(2N40$=(M|?Y~E~r3}GbtoemJN1BRogJi|Hd?VFuKuU&VW zLA%oF62(@{X99-5JR&vBv$PDtGKZZ<%lGd_^fG+2hbrvw8jGmW2?Z%8R1peZno+pR zKLhSIy}}vi&(;BjXx22?fb~L5qz#71yyr3x%h#aOus0fL7UpW9CNYO~ir5?OGzrt! z;FGX68gLTEY5^xv#+QOC`~Ue(xnZ7!!`C2_aBkFh6835VCs75G+YGFqf(+lGIp48c z>I58kOLiT&^;3|6J2dAza7&#i5Enf_9u)7L8Vm>Y;5gsnMR%}UzXgK3LxcW+w^WKi zuxfY@zIDc(a4n_660p6KP=su*9u~daXXsWW6tYE_n@ioW1n)jEw<4h!K!l08)Lm!A z+!%wkOyo5S%_uCDLo*DIWpgVNj)6p3IG4)N8Hz72iOxo%bCAfW=#7LC(Jvz6MP?M< zJR%}{h{zctuY?ajh{_70a)C7%fDi3QCHtrpABou8BsT)?q^^AqOX!AXLy@^!FDz;~ z%)<696jFs5zqL|W;&vFk?OQ0q4l{UbrAUx>BWe9(c-V&~XRTIfVs-+*?PEAX4z&Q* zS`HJio1zm8$D-R(4Q}b(@0ytzZ~c4wM{42SLt>Zv>CmiZ+AQe@?glqL>Xp@6-@iK> zx%*&{q_7pVIAyFxZ3pw{uHBh!n7(f2cQK8-S6x}-?W3J|n&kUNle}Ru&7(3})6uiR zTrM*R{UaLE`9uo-YY(nkc}c$eu7X2Efyq<#$W(4!ZG{b2h45 zz=>}-1ujNrtu>|$h78B3lXQ#GvAPoVLAb@}SPjJ8F}hP(siY=nF(S52yS5%6J7Ep_}`<;04+8(Yc=zTnfkg4NtPJSuKC7Y%`O8kP zeRg{>28D-I;pr@Wd45mcjdSB%saHLzzBERq+@w}4f!gT0*nBQN-IY35spp5Y;-Fq` zHpE7?IKCijeEDW_e4cwC4;ByCEk?RYkDrAMD04_fov z%v_MCg{OmLGEXt2JQ(Kbi{b6<>D_HP2~Nc4gIc3MlEfPzT@J~SM4=yp`_bur2b`Xf z@CVsBcsV0;&!=Q5^KzC?v8S_A8vl@(a(aAONS#mNk7>P7ITx62ny(Kk7eePQ!`JW7 zkA9}s>Q}h=O@9J^JkQ0OzI@sGG<_cT1v>kXNhTZP^n7?A&aZBlxsznGemp)+o}8TU z^Frp8xp}?1eMrs=^W-Uia5|q0cdzN}Js7r<$x-zf++_>Qu{a#`NG|;#4F~s6!`r*p zr}WJU)l3Q}+}&~I4#+}gnjZ--*&#Jto(}uhRZe=P(j0eu%oksVbKxL;RU2MWPsd65 z{_f@W9NaNai-TdObl#oRyP5LKsWdwk<~d=Q%sgC{j?0s~3;AHymj&h_c}lXWtI2is zS<17*?Ql#blk)JQ$B$0VUegch+Zr6>^>L?rHZ4%ef-uasTNy?=X6fuS^)kD=drjtN zeD8YHmxja1Sh~AD6R1onE#}Up@_oJkB;KVOyht|F)J;`>K=|4e0r6^+P< zB}qSBle6?7d0e$w})%O12Bf&FL(k?zPA?lRNEkeDjVyxDzsW7t7aicfi-A z6R!6{lj(DMcDB4dd+FC+^S2dnLcX5Qnqr3S-Br%%tIPA&T}A?TY4)abelULOO=|u7 z^YLxw;JTE4=oNAjnWkkSS$n=1QA@7P&8s5Ue&OX@`KHG(4Ot>*<@5B(asJ?S*t+lC z=OMRbj+alVP1(xBIhmBJjWfDKp50fP z94Ft9C0Xjs$`|P?rUe=gO#ZxH=-=GQRQe`G&kn%7SikDt)X8e9*ngIUlXUSRd0Fff z$Z8s{Ws9XMtt+|$qJ67^a&_KbR9bR|$&k`bQy}wIvE93+`_~g*5SaAx;_mr?p|YhS zBn;u0JT2v=vq3d;%k?Ct-p@+MIa;1yT~=G8}8lOGPCwgm6t}stw5FG+T9c; zX$Z$6nZLcM3OAYJRfd)BCVctgxW@Fmy&MPs-#+H+5ch8~cZ-`8|IEJ(vNtIqbyJn5 zgLZBo~>P37ce<+&@rg6dV8uN|cC&K79wr&nx0RlI0srPFq2Ak+#sXK4YX3J>E# zZJ4^^U-QTOjAzoro8ir9O26LUb_N-Nx;hm|S-Q*2Sde+@$Tfz}-c+s%QlXa@>%-1# z_U2)kPtVClYjjuWS6}WRJ`~ecK6NFH4$d<7r5V$|kwF>mszQGxaxZ+6k#6Y`eR@BZ zsJs67cqa93(`f72@g`Rizqm+zM^`GPpibL?Pw zQ3dx`3%G@j@9);$cPlsKL26bxzb-sv9`1(o*Lqf}6sXJ-`!a0Zby;c%?vnH3YjK=p zW()DSo2xN3O304eH?tz2x#)H?d8s)_p7pX7@`W1a+KrQ^=k)18^0;~0B@bkQti#H8 zmzg{}D?MeeP9F++xiDF@X#T2RynD$Uh_wQje0a^$)p_Ok_KALd%Fs{3L+dt~m0wf6 z((RIhpkZ_Laj$mua97VH#lka}={3%ZLj8HvELMl*r(C_09K7=B`}4b({&9}#msKoi{3d~VTJyEvf6H>XU((fSZZX;RZ$>o;*C^0pY`j~ zB$=MGsgvu@L-(4h_S$)xWcrKz!)$(cPBv>9>6H|Fw-2=!rd)>8sn2G;5(Uc36X_-k zo@KdFdKlibi+-MdnA{DrmnD8wSd5ohVQ_apx}ROtde7uTok@>q>P5aUQqRlN;>)OV zH+wxken_^`(?MUPlMi==M*lJ`4Q7`YnKr1Um!)b(>XIiTseE(AFIf7fC{ojT^)gv_ z$aUKMbG=sSmBv@#;`!|A>K0s{o*$ncH24{KzP)QdjI;N*&6gIP9&wpVNxmqYfYu#T z%P-oq)Y+g`FEXe1RI|vROV7!Enuq&i^`g*weO@%u7q_`2W(rW!Jg8M??K!wPyUkSw?W%n7GUOTIvRHkAdqnoK znMzZImz!nwe3F^7^Q))AC^ODiiuKXp?4tKHtx6TZK9yQG%_+}K2iNI~es0ho%ctPH zP4~NHDl;#MXEOEDo8%VNI^Cnjw>OfUn}WL=s`GHrzRz~&56nZim})N1t7*99$xkQw z;jEJCUQlqaXCb@48o|B%>9~8pEMC%!lgjI5iD7S;R_&O{Jc#Ke55=4;Xm+|wN#IX2 z`BW#@fWlw?tUfCidr)@b$?Gww2vhd?uEt)~3hXd{dv)_PyeRZ@?9+^_-b&zNa9@}g zU$W=3o1t)Zy=c6qUam5o`BI*o%ox7KoLr|bX>QaTuT{p*9ELSLHPFaR6 z3a!kbc-mv~-IM0+;Oh1U!Jh%w-Sb81ev0<$n`5RS(LHX^h8xw*ZEbRKyG%dd=FZ1m z(48)BJ9Rccu2QuZFf8QS*Y{U&@4S`BYCkJ9Ur+8QH?*+e%e9BxusJxnxMybEP!#KT z7tFlSs@}~eOSy5uoKBAU<9<2^8f`u;Uh|jLba^^X9Z1I+SvVe_q}${3PGfk`;S1Da zI%ErH*<)%h-`(H$_);TteeqJSyi^XRwQlQlHXDv=!;5yWovJ?_UxJJ2sIWXPpBBgW zC->yR>+4g$IfGpFesEsC6K~-5Js1u~jf=(E>%{@nOwJGLwJz0M6gtcE=gtK`g@CS4 zuE|cSmd%~i`Y&@S(`3+ z8fRkl^0qxmUKT2q##8;CY4%IG=H1QnX|s58m%W!xdb7f^J)>BtYNb!wbD?(%YWe5e z!fbfe9Z?N2J-K;eAz6*4-En$!H!DtN;GlInn77OPD=0K>xg6c0YokRzeLfa%vZGn$ zxymxqfH4NydY+N}tJ=veS-HwH zxrb`5+H3ISGQ;;PpmW`WqRxV@9z5Mm*{epTGwTY^-2CFQoLV$8<5ZV!a`K=zqK5bV za_{->;UX`-_Gc%#5e1UhBl7raCiZUnJ>hQN=5r@6Lh<(Y_U_#@viy1DW!bs99-Z{hrIUGfHfoQ0-6bn9PfvrZrU><{ zN%>+tT|z!|Ke{eZeI_L{HGYsP+*}I9n?Y?vUSB?lY(vO48rQQ~y8P6>o($yW@Ur;O z=Vf{!@$7POHo9qW$Nh&%nuq&frU_X%gwb`O*yk^W(O^D%s29odOA*u_CN)W#rSrLi z^XG!xp%$)lD`z1nc`d;AK#YgS+RG04tL4Y8COi^ zQmx+oDOp)|?!?maxwn97B2)&D#8JftC)+_ool9)thBMbD3E@a4aoW z&#oV8!}EFeetbQfHzcTj^q&fMS3Su3>YZZsi`ZMD^m)}t4ztN3b)G9UkC#`qCN}C7 zE9`mqxg+09N+rjv!v%>>Q*gC|>YsNqrj#wCosk>z9yWGHVjVN9uJvRMq6GhA48?ab z!5eaw<__loxcdR5vAcbHCrM73icxC{!@cC&)JCSc>5%GoRU3=b{jo=^tuQOV+W2(mEfuCy`A_*T4mN*~JgZ*!7m z6n{lFMJUI`h=R}=`=olm_AjcKXLA@4n(a`U=a zYdrRPwQ{6slzEhKN8tLKAHL^zudkjHhXj&~2}EryCJ^uTz9fOBKa?fNZ9M0r1dBYFo*VBC=nmZv1eXez7OaI zq{vW@2wppu>|iagxPs0^EeZm;bPN*+G7allIo>r~ChZ~RswDoIgj^F(`KmImUs|fE zhqo1RO{wo|&=-SOP1%e6c##&v=(HXCRNd4@Y>a90j)B9agYOZZTz-2nG;jXlfEa$; z-yZa0H7)qaVkvZ+^ZAleXso8K8jA_UyS*<-AhDX}I`V*O+IwnG=v)XEvk0ie~3 zrKIpul576?2y8$n-l)*h29P?ze7j=Hb~*_yxcHt*YHB`~TC6ofMqNV}q@4QV14MwKTPMn97<>iB+x&Q~vw>qoX+vWzGp4n?x8kxPXO^;xH} z^(>LUcEnFCR1({;s0|rb@)xA6NA2<`X-5{JN(P|?8N-vz;RB`>rR~R$A3HLKJ~ugb z`3->wy+VmSA|M57j3rT}ghm!P8wiy`18WNS=EiS-8~*smp@{(xd&7r5quN*;^GX-O zQ~9tf!4HQb@ZHdCLKY2P5Stk?0^~Q01SSYZ0+3{Z3k(Z}lfcLy3sC$fDXA5*nGXaz zmYFbNLD!Hc1E>^1*deHiUlDBJWeN$$KZMPSbVEpl63){@oDUmms+BIGNxX!54l^Wb zeH+xs95V=#rWxf@0D_bt9S%@JU|_Hhc%B8M$EFl3nC_)x6TGpcpVm`{*o!XnfIH6+Y*axh2>_oX{*y09F!idv*@b zXk*T>*|u=A<=&#Z(_`7jP%@TnV%f&+iBo*+Pb}}n@}62UmiJh&uAe6qy4B5CIOD{jSPTtqr;8JZT%R~`$Wr{{X28UWLviAe z@re~ux6-j;-&oRLLyA*}eo=MF-O9ho)S=BPF@_8vCmkbNE>YN))<`OfE%aJ%v1+83 zj?K(Y4Sie~emOI9oM7ZtF19lhUrTV>zMc7fvx~NqSoAh2MIR)YC^kgL($+i2L&PVe zetJputJ|OA?Cf7nbaJ&hZNYE8tt6tiN+0?Ni9@j*6U#BN9OL%HNkjH0mhEEMPAwVB zcCl=S`rJa+(3TR0-Y8Y*BP0pM-p5#u#HC|7(%9O^grDJ2gv19-}D9!}>MU^6V%l#HIfwqzaw2Abew@Cbnt?scFgiFVkW2c5b zE)2h*K)Y^;y9(tR-SVqL;;X65I!yw=WMXETR$E#c{lzuIt)baf$J+fYI*bi;UG$!5{S=IV!Jb_zV z(=ZvQ@Wj$(X!}~6!sGhHDLj_qA2$~zPT`4Dc#Kc1Xu6e-4f4j4zPeAG!1IeLLhjc2 zO(yVcNJ}xK-UPIwcqH!xZDEbno!GJ->prW}v3=O7p^pp0FJ>Q(lXkqy#RlT9B^Nmx zh#lTKj&H{RA6LNcD1d`FN`P)I zCQKPVt8UyEI<$yt?M4Hob02QjeY^^7l@q-s@ZnwwMm!$6C*%PqPkb;OmO5`2uPgm# z`^t~po85~_+lx{?IQE)&P|{``iP|UH@&?3IQV>Y*O?d}fy!`p97vHmyZ)7$f4xN44 zgS>GLRNlA&?5ece&9)zA^^5Js`yf_Fo9q_33tsLBtVP)w-;l2WJW!uy_dsc#7lsFB zDCpGc4Cj63q1D|oW<&xHR}G#M0So12Fa!eND2Ox!i(14k5%hV)%%K(ng-l)+C=ZXw z##aDpy-=d}TLR1M&Sm5yRR>G-+I0e{yNWqpnW190P#P!pm?1%O%YAjW5HkJ~HBB}O zowbySMPx|qa4R5zQ-?5tx~I&N!dpP0gJ!ZtPNUF8C|bG(5=oO1*%Q45NGFO?gHJWW zqG3}ED-z^@hx#ePI2ktjhSa0#)L{^%fqb7(clIBxX~a<$A9WRt09YS(hYLCL<(dad z_;t(BA%WRNK;)R246qT*2-od_wN{QcJGIZy^MjKiP+ekg$h-i0e~TE?MRm8yE=W;Q zRwoq8Q0$zcm<4cP4vL-i^RNfM@tVdQGYDM50?wY5IUuo2!KPn%pF!R{skC? zO7Wq%L>rJa&#_)=r2VXwm4q(9>IABfqN9{x2a#Zg>Niz}qgOH>7Gu>aZ^%<%pQ67B z%ogQ{DydU(7(bC9I`^G!TCjD$XlOA&=8DY6#5e@L{?iY5FV?@0JBIN}K-iWpQA z@)@A2dZYUU6!*)`>td~et2y_KqS0gl>j?^B`k`$wD}XW`KQjQDgkKqD2Jd4mP}VJ? z5+jj52Pir0n*wB(%+Rc)!Syz*7Yf@OlB@`KDTq$Of)Ru2FIo^#I0XjJVvC#xag79K z8$OS_1oDmV#ZF$M^{j$IPM=+V2^R^!(%TFR#PmgCX0zF|cZ7nlivG(MU7b#4u2^l{+X1Zf4?rZi6W z)O!s`^g#kH?b3xlwJj39PQjt*UNI}RHF@AIjinK^2}Dr@HReTwaS=yf$4bSj#i&XJ zv&z@hLnDx7_YKT?Z>VBuCU&>P?>Ct3wv`PpQ?VN#P!2bV`M|1d%m-pV@VWVbLet^+ zK&`2sb`;U-pdFT^>jJuuOo8)+KPwtd!65u8*1=f za8xNGF#^<`Ga@r!SS4U+hnY-yK_a8N`c?jmk|aVR(V1e-A{dUwvE-02 zHKUD6lQ^hcBq&&DpmTaCENs(WrZFcxp-2#kDqcc?fEjT{3;A0Jm~V_OA)-*7U<4WK z94?LlMut*b1XZx8){iHW^ZHgBt!rI4`zQ*5QH0*EUhu|*5hb_*c`e=4h;PJ7Uh)Cd zD(3*pSew{raXas_8~W%t9xI@vFoj!!A|=Trt87$S)B&3N7E$xoH`8i+yZq`%+I8s~ z!bFLj-T)Of4bxu-3{P3a1yL0Oc{mUr53YU(PV?ojU$T#%Z5HyuX3E<$2usc5T##Ll)eX zG>i4un|=D(y8Jkjug>N2-Bn54IDy253iA`2HzNWkwjl&%IiKC(WH6eUeL$OXQw3@; znosLp40G@6ruwRWhuEyVs{KA@<=8>$0+FarDU)s%TeH8gHG2d{`7UQEO@o|G6DnoGlt$6jF|AZ80BM z{Dy4coq{^13bZ1c^UO>$(g1=SrS)bPY6EoNh!0~uGrKSo4R6CS8VEvOhGemfxo4? z8-&4zU~WEp_yxjwpE4>e0v5yI^DB$b`2TE-H;AJ0QKRp+7AUv2RZ6|kC}cjfnLg_b zD=X>HOBO(WFU*Gr(*ZZ{5pBCU2o zL;f5 zKA8d%8|F5@8t-eE+d$G!1dS?~=Y9iOJT9LH ztH-)J@qu*pud05CUHDCc z@lD$N2Ey^Trp|v3g*{eCU0aM5Qims2NZlHX71CHCjWX|8A&nK%SRoBOfLI|l&+}6% zq?@@S=BwWh6LTqRi*Yh=EMVChj03J5OT?#TT1LBh2|R3GYLHZ^aMJf@6TCNdV1cT_ z|7vFz#6qz1JU_7zyupaH%^xNcA1sYa#9O7-Vk}_Cn^&xVgqwFPUOF@o+jT8~i0!(u zNNb$uCl+brNTcBW{<4uqn?CMSQ*z!i$Y^tier``i`$d$nSh0u|i&(J;H}6=naA+V_ zEG&SC6^mH0FwXOHDHiyszs-b;;HKiBk(g6iT8u@{Shlh?7zd3wmWVxJmeFod_%>{H z!9{Q7DBKMQ-kxGFJ4f`JT!v%>b>dl*kh#2*< z4Frg6TQU1ZRIgZ_h}DT$od`4USe-CckJSkaAYyeQRws<}{GjTD!&}GI-4OvL3vkOQ zudu~+X?F&s$WV`@ERBQcAGox;3}dBSRGKKlwt0bhCDChQ3`p8ddUu?n?Va_F`ELtI ztTWPQa?MZzFY-g_s0qa`JT{W8aS%Pnl9)sys5m7lASTsqPY{!O%!+mXJLHtPg(cK! zXHuC=B9%t}Lh*LafQ7w=D#h)5|4#87(=z2XOlv{wXqo6$LvWXW8Bt9|Esc2A*{swdcEJSpDuLBmmiEmmn@HuH zHmlVp&%Jg%VMgTtpJDwpbR%yz^foCU+w*Ro)y;NDj_(0;haLzRCi? zoK^WICNrt@se&_5Bbl=Na$>-=qbHH)elsy{jV4`qpoJ_l)=hV3wPd!PWk&-?!`UpR zDd4xNVJHxc?E;WSh#hB@z&o7Ty3A;(nxP5vKmswrm01PqJW!3LpcEhh+PY_XO1m~; zLg$c#i`mcyAAb(J4UqVZI}{8w3$j8ks%Gdm{mm|{YtMnj4AW$GbRx0ieGyS*2b<0T ztAa}v226UzE+$`5Ets${KqK|++C_h7Y;f!b%U?sSBxTe+!gOdwN9*@TYXOtGVf<(p z-FGN`{E4)A^iWtF=u3%oD#G|;Z~w^nXN`t?g<-2*Z5w?sNNW2UZpBfn(@G>54ob2} z!Gp~y43{oW88K;EGKYCQ+9zV@$oSD42${8kpz$n>@wkfV4XlIE-wRw6mi_RwEvVwn z6P%Fe(LOh4xY)KBSlM-ba6=l5zFX&~7KUTr<$iiLt4mWZ5{P@%mC&P1$|(6vJSCsL zQS$LHF_<+*GZWH!6K$610LB%(#5&;ZC#u_|(R4nMg8!zyOeThjc(6ey-Q6sheh)^T z4$WvP{;k6}{fs3Rm1dpk7-b{O^t$Q-6j}I&gVUHhc^nYX-E?%uZp3-Ca+Ix`(Z&xoqOVKlP1XfVt5}^Hviu^*x)c(rg3r3RiwE0V2xmQ0|7>Qlu6SwYsh+g! zOuUi$@kU-d8rZynI}$l^LBKKgnPr>VKLWWbKJ$*$y9QQyHFtji7? zqyrh)43#^I%L@C{9bllV1WOTW*G1K1<=?6waf_0of$vl}G=8Tvft{6u&y5d+RN0-x zE`^E>%Dl=vb;33T-Po0ReI$0JK8O=X|E zqIL#6?M!usG8Dd2C6-bY82MI*pCj8q7;_dvU63rR>dvE_g-**)Tu=^AKTrqI`rvT7~MQdZ5EQ&=!pxR^THz_sqrHUHSuc_ z*BJ5ws(@Dsq1WE71Dfw59K%1n&?n#^alzsgiLQ^87fFD10R5;0wLD7v+Qd*wm&vGDQJE+odb}^V6q< zXOuMVY{gX&0K0qK)-=>LG-0IF>2Dw6CVl{4Qci#_8?o^Gx zdJn{5VX+iQvX4-76(sQyd7K^>i$xHe3X0FTa0gP0GfrvXz&?-)N1zZxS%zyE(|suqv!`@e%$pEi&l>}jsz*; zPimnV3Y6+hNQPCL56MLUD+b}IAt@jj4L}y}OrXJ0H7ZSnr-}{Hg%5MI5kwFY2tovJ zLnz<{CBTS5L_%Di8P21m3f8tw0MAczqEA3$|>2U?#;dVd+g==W1i0b%R(ds!B)Zm%bJzEF?FKo;mL{;fKjHSOIln%&=Igtm zfXNiQDZkJr>q3IT5i?wWxJp=R4AJ&l+d8fudTYnEHbS0iTWb+%I2u)+AaX$Pa=yr{ zJi$>~Egv4y0-_ou{GJfpsH3*L9-2i(w9TTL8QB6LSqP*Gj#lr6fZ@bWwN`N9Q+Yxm zRV4e6TKBI2>lYR~RE`p6)q}{W$`f?egS8lR)q~2eYO7yC{fTIm+$6r~(N$kl5em3X zY4WMBauj8AisW*Qya}x~p55K;`dNc{dIEzsvdR%;VLzVY@m`n|*lYDJh~%w4ZXbs{ z5I9DmFt*hVVvomH?=uB8_?)W|PM(D=IgmAukj9L1Ko6=+EC4a$@c}*r$+9@<6>Z4` z6dDK$AM6BQO$d2jZ`0vRlj4<(Mt zf&e%w7$Jfwkn}Tq($N>#^_%OdL$2|aftUkac)W`+ufUxr`EY|ET)>U`-G}e1)(2GN zcZxLqNbwUCVUPHm7GC?fcbnb+_SoRDsQEbLWzO#?Eh21;t6C{A4+;`!t+%O6qbN+2 z6br8qS%wZILhnqV`aq8G1pht#^WWkWlDQ}?S@6e?ogvRj2@&E6#P9s{<;M>EE(tt0 z`qP^6sT~YJKnx_*L$>~%R13o&u+=~RJrMr^d+l~NM=eRZu0>=ca<@Lzmnz~+MvZN4|kH!*t zJL>{r!f>PnLKA5Su_z>W@E3}Li$vZ6k)IH$F(MsGn`1%{d>x6DWK?*kL~;~hS-d7F5O>`gZcjh>x7ivhN~lX^VX$1Ht{| z^gszaLxG>{tWqo507@lb4ygepgFW)YN2p9Zat^>yhy+8#J7s4v27|FCSIt*8IpU>)8 zX~nyZ3aV$;!dJC&kewo+Y~ab{1DODVt0zI_f}pC&78H{=S4-S`$l)F^;qxrZFVLyh ziYa1&h!Bg3nu$Ual)tHssy+C${ny_H_BEW*ToJFKDr@iV{}Zqst(dRE|^|M+1i8x;_zx!IK;<5>?g6Kb0L!4GluwZpXll zT7EDhF1)O+cw_auH%l9U}o$7WEI2z(TG9Awq=^+H5Tw{YMGM2*#7oogk$(7($c?!?l@0IJV%<3x0Uq zJ!E_WWv~QdpYB+*y*Ox6s9RE!qr9LP|FXB5sp$m<=ry+<$6IsKZv zJ}kEny*q>yDO^c3G^>abMdr}VI+!0g(#)YQ&57vfUiH!}^iV2B-26*xQ;$;cp(cW$qaOf@q z6b25zA^(foBl5gB)D9AfJ7~O~L*393d=6~{a#dl=Lt=F^k$#s-l=wdT6P6W5 zgLKHKK!+A|HyAl(lEVpwjO#;Yl$@uNN>p+3ufG9D@igeQYbAa%ak&n zIMg<|LEUxja~n3Ovqsie1L>-dnKiW4fSRh>M^s&P4L$Y!B?AwFi*yo6bgeWpPDj*6 zH?4_oS_@rI1KpDL8P@C(UF&>*jWhIIqiLG!YMJk@VQ$xOww6};IW)@nj3V@e+HO>h zu_;urS3bOJD_rQnlpHbK2uGc>%!H9bA7bR4)op%$vBQf3MZN^m>H-GAtRsp<2v>@- z#l7d|7Ceq5^oACFD|^RHZ1eFqt1W8;LIkb7-(D4Xh%*@oZkHXpR#MX3(98@;Zr^OV zDvFpKSRM_y#RcI|zGZ%a==S&Ftdcd>2N{Mg zp>K8wiq+k}`;{8#k(_9DWCSp}?jW)g7+U4ko1UDZ^&oT9h)$gpp3|BM*nySPw^vC& zbn^HHRn3hhlFPyK$lp+fRH*|Khv?k?=DDV~kQhxY*ueNUCl}ZyOjXzVkdoyVq=cAr z*~@=c&gE|g`>34D=NN>o@}nRuz?0jAwG;%VO|K{tzlB~|3LNc9ZfBg~)UmgKvAZI_ zAU+%`&MRABOL|P!B?evJBiVC5B@4V@}pT^LPu#vWcrhVp(4FJt6iZ3tS)NoUst< zp?=I*L^kH~W!>}SgCDB;_UD|w)sgZ}!U)Gp@fq_3vDL#IwR0BDM>@Lpkik9l0YULH ztDHSQWRwF{3C9D|^iy8H5xW6fH@V0?PNVfd)=_D1H}JWR@j>|bdw|15Kl(xVZ7_!l z@uOnhSf9OY@N|5?k@&|cy!CPUTjHr<0?6JYaO@MXf{g}-y(3%Dj9+kvlF-#h$oz#? zEGb|zR@Ut;?#y^YHW8LXeLTLfooh5Ig1`qn|Ir{8Ig1HMI>F#u8?{aMdz_O@e7T25 zQO^iEcT49dyywHQh}+@+<}J!&xx!yVwuzvu?cS3SOo#|{Uq*m!H_V3nrdw?^8)@K; zHNciSQn64$Lbvq{h1lWlYH`K-wXe4D+eLlTJ3oR+_7}JdBBFU9u-?D>E8WoWn2zsg z(E17`6Z=#1W_(3~#_>yglj4{Zd-=~AlM;&L*VfCUv4OxE`6gLFc;54IXg-)G9+=)k zXyKdE!Tk_8r2hT(KD-dO_PviE@2%_vAZTX#_U=2>+Q$mVr#2bbZyML`8E2F)K?1eH zn-g$+#mBH4tVZPo97<@!Xv<@p0C9pPMEYa*B} zX!6$xVGI;e@wU+vULN_c9CGP>ipTq(;Ndm6Up-%SRPG1F{;=m^~QSRnqiaOcUY5`1q#&Yz1?eu5_pjxN=JP# zNE&hBkT9^=BI>WB_P3%(<$&;guYear{|y!YzJCwevS-7LIvw?N#Uz}7 z@x|W$k@3$OeMsykrvg7`5alM#aA0}md=K1;VX%lJi&K&U39Uqe;aE6wbb|73azb+C z2+)vaiAi%RbWjkr1bzwxDZsvna2&NB@OTuRpI$3t>;PfTAQV7tND*yi;RDuOxyu{i zFz#FLdZS3}-SoDxSc64XIW-MdF};Cx5a;*8cS;r|euD89);4Yr)=Z0%wqUA&Ua?`XH;ITDMuwpMbj zbR+@5Z-R3*jfdL6qus#=#XKh(agu$|hUCh}%>xY9peRqLyx=AQTUvCS9z-duIkrea z;@n^Wx9?|EXe>!n@mn&vSS*ex)aDVzPm)v;pdi4cI+!F}4e)X_mL?9-yH1m!0lHWe zD%tK^`VQpgkO~>nRjqRs12yE(B1ps%X5>1PcGs8ODZ_CugW|u(HWrWo(ysnsr(MCW zGWu{~!(Ts*Bi+%Ns1^PYK_umn@iTNT8_{dmi3DMxA6-hp<;sf~qMRhFZOd^&z6ph!RoZkg-%m-MFMcG7@ZaNQh&cGC2T9G>}khBxh@B zd1QqYvM_ZdFm*CZ@1&22b0|fi>`UaVM2(`~T6)_d0n}(x^w#md&7I5||HtQrbjWBB9zmglnXZ3KoGQLTkvu`9MgaB|y#U0CqqN zSdT$Lv_R<_*CQx=!~y(ZA93!8DAKe(Vy$V2Anqd+dDO=UNTPlup{?Cx2wuhhk7q#B zaNe*{T{s{#txaDvGjad4paT?41Td2s5pp{>l(6n!ieO4mE2$Fz8Y4eMM#x)PehEi4 z6&SQ0%7m4-c-R=H4CILj0+$it-k}T01U9k3C8FW05hUv)q7B!1PNIoJ0up3Jn;~Hd;O7+sGO*Z?1d|-wUEf9x~bGR{O^O6i2yaU!3kk{0_)wSM2;LQ zw!s9@jG{Sv<18;qWgVfMn)>~B64D=*eVA7r9}vF${<|F!njB@qP>7sxxuz@>!w-oi zFB1!fWid)%2Cp}Z?xQiZ?SNv4cvuFq9fXw*G`gy+Bfc|7#f?DdNJOz!GgNbAl}c%S z`i{)0!;Db&i8F)2^*iL;p=ut{;S}OMA)-wL^IRU$j1kCCJBE-UMH_MLAug@~5K#_- zi?xt>hKIO}ECK<^mY5+-Nl}FKMw_TqRnO>shh_Nv_W@#?2C~9?zqSlcIFZK8VYOtM z(FhKJWS7Xo!xDlF1uDZntP!q)C+aB-XqVAXoyDgYAb|$Q2H7@eb+NT(@XWP?Y7vUy z{tQi<_~?;0(Fl-xk|JpE&V1fM!!yW_>7&$9%1KR%AgkeeoXarqN7WNgXalg7u}Yz4 znbY`n^~InEK;4ykhMU5byB4PvxpkJIbyZCLZkEHf%DPp`sixfurB(CQ{0vo8jiCdD zn+a(cY}T@1Ybf1X)hljL}-qI#ecl z)ez=_e;IL0#Vd_|*0C$8L)1ccSB_e{T`8ML<(%wFD|?c|9JGczQ$V4m${IniqZ!X} zZAUYdZeKUmQq9WsWf_ia-#9;)lNrSrA|KJYWx$bdUa zxHwzmMYbCX8gEt_i7988I^SBnP^j^F%>w8(*pomczyS2dAcxA>@-OGbo5I{F^)T-A07R_KlvMYJaO(H z*G-l#KVCZf6MK(SPwN|TP2~PD90<9e-T4>-ms}WJFwU4%;Q6?{W_#cL`?DH@weLwk zLWgxErT{4;xa&%=S$BU=L#3NLw{(L=Mw}zp%Y^LN*3~EiU#HI}AMMG^meLvUPd3DZ zxkUhpSNQx+MxK~qY}ZR4v(6}orca02E*@qj4I!r2wd3Ys*rde3*KTl~0MLWnQFcUv zTZHvZ|CF;uYTmrn_H*c%oEjz+N5fI3~)z)dP))UepJ4IkJt%a=%S{kWiNDE*?6LxCZE zadmW@)MXN}OMAC?r$g7PRbaGtXC>=eJTl&5&9~uN`)YF};jykGx(-QZ3kunfA6SOb zO1x}1T74nKO->}Q8RCQQ0ZSU=1E8#4Br*5|rKVFXBZ>ot zoje&TjBQT+{wGZ4s#xFlRB=BvuVdFD>bH0lX|pJLCpO+b>NK(>Vf`Cn^N=HARC#oN z#g0ZhiS#>|g3$)-jelx2pJYi~0y>nIPtc781tT36hWbU4@+`6mEx5kAe$byP53gI! zhJ0vM%D)L=Y>-}Jhab>_lFWkyYo!_zp#>~`y+7u^*NcoY+~Mc@ixl<#4=8k9L3$J? zm=7t8nHh|iSW-5*n9eA0NQa*<8(MqZ8V0-nvf--MccRac#bO3wOwStcmw1b8RdT$- zNGvZ#zxow1yU&x=5n!m=oToTh+H+Ajfb~}xl5B-yG2Yln%}f_Q-0<#>f8p%>6JzT) zGpZC0|NY}9d{r#4jSqbqrgPig{VJTJw&=E?AvRsl0Be5`}gKuocCs!W0QJ76%MrIzJ(v^9u$B`l4?` zmJUOL_qw%CcMk=it}+NH3$RwWx~mUoc6iF|nM+tLZ@^nC3}nfH|Cygr`Ww9f7d%4&&437B zhB;R-Y8>8Db4Y@otPfkF{^q<@fAWfxxa)Y>9>JKh|Q`04naeurvH z#p+jmZmuq?PcZ4@NuB{ICfr7ZI)Ez%ws&36VUlM!*B~>}tP5FYxk%F|^VEb%t>6|i z8ET^)DQ`KWl1VI1b7Hm0Ex`ne5$5VCd-Z$KGP*}>0eAMkUvz={fuhUaIY2TP>*a5N z>K4EjNRHUwTRVJoa2CG+YC~w5Q25!7DqIpR{zNU~x(1d;a-O8KnmNEvRyP zEMkdIE>ut{TOao&oSurVn1$(LZ~UCZnu?iAt9>h)7<`oje5nBWG&&=7jkn`2WVU2hZ2M1 zy`NdBZfTGk>8pvD*b*}L;dJNS0rLl1?|dfiH8cLkXNT?y*XSg6KQo*?;Wdz%97S8a zOxO~zvUnxCE7SK8J^iY(ebOti-8dwR07Rz>oWY zu7#wD*8Y)(-h>KEqkSf2^fkzBz8_UWA3uKbTr(`BdQ&5I0_#goDhQOyc2XF711aH? zbFH`kSvgnu!yl;ej&iODaqCU_Q7pwQA-0nY58NHb1Yk&H%{KjcW_o&;eW9^fyTH-NEOZ;~YE4K*hx>xjUm-J#bHG&is!pfNyBgilnU zJ{3=&vc%o;jAljTsRmEAWlexJ4X8BLF*HSB1=-LjXaS$Wd|m=yy>|w4_%6TDk@c{R zsx>ACs-Y7O^j=Z#gl~xvM?n9&iDKBd zmu3Akb&Pu3$V)pc(i?vnI71H2a0lz!!UDH2PhcpR(a-q8^iD|jH)@Y?bmAui3CG(b zj=%g&a6`ZU0ts%O*B-ZLF9{~WMXhA_(&FBTr;=N_KElrRQ?P=d7hrxarm)q+kkP9r z%!GYkCJ~oE?H*Tnn`GIVszy99=(KhTMR*|r$|eYWTcfroi`ROLcXND9P`}vytXg8L z(odLTi)|8=r?>V7{kGYx=7R`8&`l8Gi%^ZD3vaLedBb!4HTiG@Mu84I)Hj1IZzxOL8Qa)urQz`AaVhP33)SQfuh-e+Zv=`|!9A&-z z`>N+3LhxIw<(n}9Vud_O1`wa~><-0~DdNP`9zzLFN(GNX;F#+7`#bPr)YthKC*FIR z3Cw(XA}hgLRVK2>N9x8;Z86wH!+&F=!cN!{R*Q@brXn&ZxLe>oNE_=LaHQJauDByj$~I{TfarBAeFx z+Ou}<*y3IcUJZI?%GJ!QUki8Ps$Tnz*dr2xQwcE~mw9Y^mO@;z zmXOti+Py4$QD~cvSqweAQCFDq+_e!Ra(r^OfX^pqbFVN-cRqGmdEWc0wG?XsrqFIp?y*y3r zeWf-S#Z&JEjrC>Iq}})|&i{Hmf(4Hr4RErz&^8ZTEm0kI4jfe4L_Z2XAx5Jo#HjsN zGY#Jmqh=a~e$@??r&(E5<$(-27WXA)33bBv$=)V%rJvtuQZ(jgyvizGWrZQ%C>ul4 zC@(N=L6fT1t{Sx}E@-9ee%gYXGCDivH44mYj|4d}wcn9sRc|#ZnmTJ#sX{gj{!7rF zrXo7OFNai%VaI~Rr$wGoC0Lal$)aFT7CjAMuT_$DXBDu?;^Q2T&Hb>TVur>1u5GN7{EZ2q)0|r=vC6PQMwbMTPUCCr*?F8P>`NQE!ccO_p6BH#gY0WiI96lc;qeA$(%w<->cp?v{-<#t1(*MR`M-5XuOTk7iD#liF6sFYn-fL zdE6sQ=+I2+b(>*Gs?0}MB_}BJzuQo8Bl9PC)`nS`Bj78FB)8w+0xXtjocRO?8pe{7 zKfz%R1Hkd$pWtwY@#_#t!6l+aL?MNZjBxMr=Cj*Y4lQY3Gx>bXuk1SeD@(U!{r+-D zb=)Ro_no#f10gH2AQ?Qg5?e;3Ah!(W+x71-07$J2xdAd(%5B~al*1z5q)K_L!r>Mj zx4js``ulg#Q#MqVZ*cp2ErC^KO&;opcl>~M+nzlSCYRxS9c#XoYv;;*GCA~NX4cc% zTmk9Gp#uxnb}Vn^9<3Pz2dgw1Y{31+{+C1dpAGISwMQ!eMrYPAD8(p3AGEM8&|D^$OJ}n1A4TP70zY5x zVY?e`RC9yKnH(^(Jr{Cxc-Bw>e{fd0_ti$!w&itA1B?+FP2blPQSel0xBapWE{}$V zVICM_NGah=58kSPOIeg3G(L{VkN}A7`egU5*e!yFm$;+Sqv`p4e#pWx4_SFivotR~2@-8Bh6bm> zFAm38t2k~G91kCPxX-#DTj&r;h#crUU1b&A)p#{MT zD69OppZsP5LowJ&GhfY8GmJZs3~=r=JLbVc^f9BG(LtS6CGk~s4b+EV2^%LsNYGaL z(Y7%`(A%z~>S`RtXe9AJB-)pz3!-RNLO=9_6vo7NbY8*f>8U%oS%#AMIb~}Jo_(|C zQos5_fkr%-)QbFq8<98)+%YgzRig&HD9TbG;!Ds`LV2c}|1N81NKe z?4rB`t5Q?}ZdykBHory7mWN)H{0bQaY@>mT%aPD2lxcuYUFAmr6Ar0c0L&Q!H!f*_ z(o8gkI02_c)hq0gRx9IV7KrU59*550+#2hw3G@dj;ocFRQ5{m>E0Dw>qp*KBGyJq4 z`@wf6ZD_R4(O_K~tyw}OJ+x=1OZg0Kro|X00nj4@oFY9`rfk|>opW#|;j`~!+s4M5 zTd7+qP{xx%r)YPMuqK=8vA~ndzyTnyPuG`}2JJoiwUba!SfA zdm9I@UGbcp+41WWeUk+&S&TfD-aCxLM{TZba%UT5yJ-stV-zM3XJ^5WKJde)s{;H1 z&t7`TO!ybM946}UoK8uBB?vP#D|}Cc|969!owMA^nwtboR7gkIYYtBxC+AogkHbR} z9%zY*b?fHVoiM}(=fv%!^M#|3f!IqdnO0!ar=a2&)qqS(roT{=|En;!1f|yG~A!JCA@^l^OrZv?AX( zrFP7w_l5Ql*?@aJjxxW|>KAvE@#)(7J4G&sf0IeAspIVTQ+YZtyA}TE9E zck{k9MXZKY%YI``u(qh57J!K5wbE5GU2?AwOx2sbo!QPIeE&enCIKYjdbZKnWhSyH zSEM}YRSc1dX^Uy1K1KYh?2%+mSEZuS6 zp~5xP)TwZi4c%~8OM38*q`|A8sEr4F-Z`CvPOS&5%L`pTmJZ&UAkY}{E!MLzYu?8^ zv~hI~@yLH6w-q&KqAN zg@0uSQ^hqI2IL}^NuP`k{1GGbl1mng9Q7<3GJqqqHV_$TYpkzSVZxF*Z%*790s-gBTTC?N zu{w0U{yV_#wGf3fFsiZ-Dtd?F^7^|00h8kYlikyT0ux#fojB?RX2EZHewxG>!1zh?Apmf?tbbl>t|L8nTz!71MfI#c z(O(zz=Oy-Dgu5oSi0la*t{qj>trF-NPj>wPf z6DA2n|4CODzdA$vvFC8`cPYK!8Qv^&51lKJbN+>dEiaQc2ZgUpLsl1aIM^0XT589mU$6L8cAN)r8 zYUq*eVR$lFd}>EVN)m*@wB;rkyZZ;9bv4ScB{TT^KL|RJHx*+ws1Z^Y9madjn;8xcv>Nvvl8W~i?>c8el7T-xs4?18 z!HG>)G;2(sw$E6J8IeJ0(x?3RYg3wl{^dOdwxYAgh2#*gIgp;vM%3P`vpmQtw8^>?JBvj zzI8dfouSqF=#C$yediRt8k0^~vi^92OSp3kI5W>1i@+()= zP}+Q?%x6HRi~X%g1kns*=)vjA@(McXVW7Kr##8BT9Q94Qww;=A{k+s`no7Q{1kSkN zW1$Ki62_NS)$zgW{#Z1~$EZW*uA$kK=oQGK4vp&JC>=tdYZ;N*p~o<(oEycNrYAe` z2FyWwoa(b;S42DO?9khF+IJeStLTYjE9C1FwSvG1$nNT0?mo*HA9}F?PFIV8#QsC= z&#>kVnhxoIC0*}g_ezMI?ipX_FfTJ~1&@jZFqHmKo)b|$Xd;tQxuMllji3x5FUWqU zVh2QBG$te*<8pq=&2*UMKGGxS<9b8c;s@*Vjr37(#KZLLxYz zHh3*V!%9&bT!c`G@#Sk?CkxDEVEE2RTxslYo_*?ljgoQ<&p z<{iZrRQ|+`i%5hXz5Dwa4NW(ZN{5)gYBw#OT#_1;s(m0TFXqv8s|OuxdU4eCDOpcx z_L{qaZ>sBAPIP={ORFJP(WmPcsG}eUAAK7E^DukvJsc8PmxbNssN^uz0?fYW#N!5e zq6uk&pGn0Ll`}NF-#Dk7tSUH`z>+urZ}2v<7Oc$+LTvOt^%(j}0O+Dv=ufllMC&Jw~5_qS4K0*FCdP0$% z64K_I5F@Y)BvQ^o0xOq|&oE!N zoB%jq>`-dfgk`ecV8ZhlWfU7?SGv5CB8Jmtad$+oCX-PW$E?UjYXXS)=97+$Ei(1u z3&F7|qx0$(hysYEVDM~@3--IEvptiW+HvaN6$hTkv>hBsv0P=GM2F#azkRZ|gv{UG zaI&q#7_z+p;E{7NcTMHNu6xfK3Da6Ev(S7>qNo90AG|O#H6G3m$xXFguvni)Pg+T4 zAX3~aneo2Im+&!7t%-g8Sx|Iu_?}Z%StMAiu(Q-U{b;s<&!RmOxQd=lu77m8D|AUq zcWM%mEc7j5Y^p?2P=v7|>gk96Ek0A3CCtx2qzuOqQB&lL9 zWV(ZYY337O?_vJKWN7HV25xdZK?I9dA$J@JwF(4Yg>g8gx81H7{B zFvahqR>=r9@~8v*xj#fXGFh%nA{$$VD)g$~m{yzKWiovuFl|L-*D^cEaasr);x-}< zyvZ`T4sikHhDAj;UU+=9slX|gihw#%(1@>Nd-G$Ge3VA+^uhtW$Y2Ih-e};czEtu z+4Go}{)`8irp4MBfS}GGxweX0&D@XYA`>ymY>%&Oc^e@KTty7qF+E}y)-Q?Qq&4?w zm@yKtRSS?YXrs`+2%aG6LAXI4+5UB$=GA0**?l%&%HER>lM)(5u1zUVGHCPXK3SyJ zdsH-M!US=f9Ic3*6%pm^-6PA$@xQ-~Gl)A{HTgTH>d`w2D@jG?(L)D_IM^-GpPzWI zzvA7x+dBARdu%FVYz84h*>1>j1w1F~xH04k{m_*>5H7fBHn`#Z3{E$$t_Gt1B7ZV{ zwmsD%r{MaM@1xS!TMM#tXCHwl79%!WsfaZkWU?ACV%}3J_4&2RLwns6u1@3E3=tam zWTmYF)6}mKAX&kGLXk$~@`Ox*_KZ?Es3w6jIX$1l&YxLMY^U#uBe@J?EfTg17Sf`9 zRdN#4c(@c%49X3la3`~e^k@Z;`VX|6Ic(3+|A5WpIca0Tc4SpzJ!G7rZAw!Xn8PXI zTHL0gBKe-P6wEU|uGwPnNgcVJc-7R+Z`b zAdOh091jWoW2?uq9vV?uj1DwjJfqMP>85QiXd&TSojFVI$)YgnG{Ym4on%{ta*ce| zE1h?JY_jKqCK0ibY6mBTdixVJ!Q!_t*BQcV(Bvz9D4$+4yu1*`6$|B7em zRAE=JsqW~Nw~aK`cIrb?DC8|Zz&01)fsDmjxVW^Pg8;jM;$cX_pVX|Buyo1IwXkV7 zA(yAeCKqNEXPMmBZg@U1{mdd_wYbbT^!Uy_iYvEP>%YTCFl6~7o|kft`dM%2A>9W1 z!<5ma8$xG4pgGspkwDPG73%WxU2x&Sie7AS&uu#rU*W?MVL=Klo@7c$; zZcSHci$6VoeBW?Q%sCO_s?N%W8M>#jc`U9W4#iF%`Szni)+Da{s;lYcJmB0!!>*Y9 zF!QG7@yIB3n_x3pj!UOz){RC^v`x8?Kp3!t5)#TGn zrE6f%!fBo3?>ooYlXJ1F;Z9|}5g)-7$;UuMisAk_X?6A}D(}V94N>wx?J;UV9dxL{ z!L9F9Wd+t6G*zH})r!VA#BBc=8@V>JetqJ13rpnebXfyw4gDc4fWJb;yMO9bw%+W1 z`hd64L9FwcD{G%kk0(f;yJO-CkMv40U(sO(&;p~C`K8@G+}Ty1ay?RQd*P!T%oa`u z-rj~lE41luK)FAKFBzIao(t#2Oj3731-|MAbt0-eq`4Kf%G0^Y4xH#3lx@xN6%-04qN zrl}*Mn)M$ZkEkhbyAXc8Ge~Ld!~s7Ca)TpIwL-nKYc z+`ivCG=x>t`MHRQme0cV#F8j4l0WOiZaW%?dFba; zc!u7fzb%IJSd>+s#^e_l=YVk9cP!FJ1Se#!qh8{^Rb-aZn3oaPmqhQ#>e{x6nv|Y%dE*goTKrmnoqgc_^_8={dy}+&6Hr43T_lRW1MgQC zIG&@A9n8aqU-bDd?633XxA+PDd>He4#fbQo>|wzgBqRi}GhL^9Dy!`49(ncvo69|F z9anDwZc&3(gALcI-#~rbO^| zL>qmJoaHdXomZAYb-i9xRcYARG*oVVA>7yVUg5+4ISF!%>N?G> zUnWxRP3F2BjW~+w*x5H01@0w><28@lKI1<2Llp%QYY;anLvYRPm~YI#UJgk=cyHRE zBT`kgQ}!8i-EM82QATf09*zC^XbhUL=P8`J8Xb=EpHi#L1cdh`jn$h0Ka%2#XLeCI zNJ%GoM?p9po>EEQS&E<9efpunGiU%5awqV%lxDUJY%nGTnqBAmrTj@ze-qCh${p`@W_HI5=&@o(LWJvUe4w6Gan%`e)H2 zdvw+~8CYeW0&m?BlM`+nQ&UO1%AV%@0}}FDM;)*BUKnGz+kxy;e%DF;K$IxytH5NX zZ(I-P6IXEY#W8Mlhr5dYB+zGvglUEm!NH{@hGCbY=i`iaHjKj-ZqWl19)146-;Yhq zodlT_6EiBW&4R6DB2tZ$jRGrw2?b^;tgnj244diiq6L#gCXIDMjbmy6wP`z0US2va zVI@T>>qcIUUxm-DY+rT-rhS?@UBEA(G=UJhV<=69N8RF-bsNVR2S&-m=2+S&53=kU zZTY|yENzX<8y2uxLqh`WHFEb5afoCq#pZAzv9Ton#iVs(t(^H2A)>8CQw8kzIx=nO z`%Tk&WB0G5gD70Hzyr5vM}276PO3X@Xn#!HZvs7DcmQT+ilu1-*s_v-`_IyRp0ULZ zA1(60L`F8;60#E@8JitsdL(Yo0tai27JfdL7uYK z_0p;*(|&z;&x8$Ss#2$jPUO+8utIB6%gsjYpOb(?w@wxMeX#(Vr2=f^`;C3$v<@u* zezH_h8^;JAg7m@Mm`8QV>T`+>t$Lf|Z_f*<_`K74&aRXB=!G4vi<{t1T7;k-!l!j* z>sRnJn=zLr;Y6h@TB}d{cjnUTfKGLrD2BJy9?`PR1F4NS52G7R6gh+w;1b`GJB7hY zx(f5?g6!kt`+ngcT2_+`eV<49VP5RXv3RquT6<0|nhhR)2G#<~CFb~KJ#CzZgjc_3 zuD#3Bh?i#XE*=i%O4SM#YmBKYW9Wucrj1>TL{RprtcO+hJ}7z>`$fZ=OXjo01V*nbI;kr(e8_?08OSJ>Q&KL5e&WJJ2k~ z74kgR-7_a2*32sST(#?C04CTGJziE^@tF_lCl+}gz5GqLQw-3vxl5Lkm>;4hQDd9= zO4(KL3#sbtfGMI7mAiGn+=KLwy&0>M@27c{UU90Gm5!zQi>I)vjA74%!l9HvPP?t{ zZMWVn4i#%?cc#KQu7x>xeBZo1g?iw2?_t`t1kYr^?&Q{Ud4vbs#IX&zm0)YZ{k`S+ zbsfBUF%~XB>f-jGSke20r;(wJA?7J~(MsZBNZ*2^#Hs8y;B!68Q10Yg51ha>VD;FO zv2Cmb%0;6@M@#A`O3h4u9P{!`{1y$PV5zcHr(mIAZ8dJz>g&xjJYFI6HF7>~)2WQ!`@E^G^ zmL!GGHl;F7U+O83tf8^Tt8FKH)_cX+)}|&IN|U`la%hespqCQqG&r^`IJ*rl#N)U40$z>Ct)KupiN=OIcm#O;OTDK6=?If%7>f8?2VCT(BcSr((3Dq z%!OuY#KDDqTp2$jgJu~!56h(ZT{>qM>+yM?#apQ=y{ugH^V`zQh=AKU+d}-3p22b_ z^@PJj+b_LL6XZ;rQS7OM%VuuQlIS8!il^$~BpBWU~1>s&4Nz#ap;-)fU0hnD?gP!3G3r$i=rqj}CVXJ_yC5AT-u zwhO@g-is5fyq~b_4cw$YT8DTWGcRgyp%vp;L+7`iE8jvgCINY`qGc9_*b&K=52Xtw z(O3J-@n;Q}nKne1W;>>Ci+rjWQyiCyEef=WgA$qZ%nzS#A4Z-C&wV3;(SQjll?la5 z_kKG?XLqk31o!Uegxgw0CUurd8TKX_CY67)YzGZT2oDfvOt;L(7p$5-xbk#T)+fd^ zGaum(R>JH6I*tc3Gk->!y^T&+R*T=%jRE)tpR(~YNUJeRdk6c+olUV<`yqE&Iu}hX zDy<5~Q#N%g=Y$--XPxrrgfc@9XJvVGUJto4Mc92yo)IQSZuVYJbWy8Z3?|wyD;7!o z&6O(1QZb`$N3ZJt>^?^8I5LUL;2+9e=@4}s%q8)iBZ{V`8r~dE>N(xo4UynFj$ZT2 z2oGwHX3Jc)N5_kzELxOyew8}f+^6xM64GatVY(@20Pd0p%>PzS)}nvBylA%Ork1_* zxpif={gIMNzaS_RXX)lWq`2I-^IT&K-!+{-&!W?KQt5julWrB)k>T3NDP&bs^IFiL zDADN}o1gb%=2b9}Js|OD-?p|nZ0ai%%bF1qE1wS(`ZzDQn@6AGHW}MFxf97c?DuCj z)VZv01J2PsvA{nVbDp-}6CWXH@f_2MiN{r%5bNCUl5rQ)`FR>tS3O|SVpMSr2Bawg z4hMy@Ehvgu-;mEgbk(^~)OR0x zg!9-f&lV2L|1u<$ww!l3-ll|B&#tsTK% zpi(Q`P3Ac-#5KR)A=2XJ&Yx$*oK-y>cFfo)C$2~r47C3{EBe@($zA3L*w4Z5on9)( zLtQM*JzCf~ve^(Prz?5Qa1BA|OfOs8w9x^x;; zJ@Fjl{3{3Z@+^Cq_^QX8;y>>#+Xsa&JasZP*565JOoXy(3hVg5abOjTE5FU;eAjrF ziz2*JGCtsZ7MlY$tA5MA$;X=2MIFA!26qwgwSAxo2p|4IY}wtBSm`792mC3`T5wyQ z4P!W9qI90}mt33mPN$A)3yMmdqLFdf$bMbY@8}m4m8WsH!@3=Sn`1NquItR;d2=ae zvbt{Fd8KGo6^cDSwHL8w*x4)OiCO+_@f33bu-qe(7hEevZzNm*Li7`)$5j=LfKMK{ zz0+41{wvuJIQcEQtPth2b|IedMC7&o`_v{HTv~|w`yWy^>1f?&2~ z?a+fw2%~pN9xEB4?H58f!*IL(^ucvnH2*U4o&%+}EC(Sa&a5ajEi3}0G+-HV?m(fN z;awR8rUDi(ZHRDxk|WZeV@am$w2Rj4Jlh@SOA2I_pT__3sx5V)hQmqDaJ>_6`Xw&w z&+T;^E~kA{+5RIpTt^7=9gG_N?&8%Y#VcRg7m*_>0e{_(3hQOpb`<>;C;H)%B>?5^ zlkgtmly{81`Gc40_u+Lk@wBz(vs4R*4(_B0^j!HdYDdZKfwbxi@zT2r)~DCkFE0Dz zZvO^CM$ob2H;;Ppnt~pvb)9n`PRFm6?M_9H`rJ_#P({E+Pyls$BP?sUMNO=WIb7eZ zS(~VOtVp%}bM`6`uMxR%zk{!l+2;0qXhylfyfYYUE)4N52SG-)@xMMfjYB-{b}n=h zxNfF<#Jc_6uU!sRXW}t2@7fmzM8)KFj`r zW_$cUTpc6~!+&vg5w<|S7QuZPq)E4_AX>sqHr<4*y3vj*Ah1!?m^1c35>GdF*z~ot zFw|fCK%pE9vC=mf5+aZ+CjrgdPH+TfofV4-Iw~fQTq2IE@hpC$NxumOPya`@dl-#J zTQjh3L2!G~BtvN$fzk#J?e+YHyVewj zn1MQL?@91W6!(S0wpT$#698T}c5lF)nfpLsJAXX%b<8I8iF{nM^N!jsP-Cr(M_)0c zZ-%oLZjX&&v^Mu3e_~g3Oka12IBy;UX;|rSoG2L=8J!q4*$q2-dxG1=O8uTY4w>q-H}mlVn|B84pmid!%@kphKH zW#+oObPzybqVcW;><%xYh+h4`H2wqYVg8fY=%Hs$=$~4;8{4*4Yt|^%D3XY)ut)v*y(+eNh1~94Bbi{fI&fE`vn{OjjyF@Y~6Y?yA^^ zPy$wb%}PsuA{*WzeMvD9XbzfFml?NsC58O{BPI?K|2lj8u=Q2z8&TbV+kV>&X@XqB zg_5EW=cti)$TJY_=3Aj$JH|vU8FigV0bMA-kxmYwTXqj^k0|O@} zAaHB}L(ObtP#@oSz~2@pjj*Wq+gw-I4)s&4#&eXzr( z(9VOLC-YCZE%*>C)@qxfSP{|?)K>K0-VkK(#TvFs6F9@94gS6f__|n^5$vJM^xC(+)#U zpdexz&`)flswyzS2Gmw%fnOIGAJ8^)HVNUVZni`M6DU?XaPC_`^l(eB$ha`D*+-J8 z#A5u2aQ;GK>2stPRR5E`n=ME~B$>pVPs<)lGXW9{+8RhhD=737zsrZAZzaE~zoYJ6 zWKyN0fIl4b4Y7p3L>7Xc?(?u(;f`^fZ+yS);)*pYp#wRP34ZNy0307atnS5aq4rxQ zp}(MtN!i^OJt?492{nFxl{>2b)>w6c;22H4H@Q$uV2{je0T!SUC{EeU*~Xd4>~s|{ zF+`M+G74Kf0_aexfqunk4Ut>k1~~-B`aXDuCqSBQB$9}f=Wt6)XdG4KX``Gbsr=u< z5Va+^b?1<*t(h_f(|Hl3PLME~#mw($J}%2=tS*oZtQs4lb1h2@>IiWWleRD?_dVc}OrY*6vmJM@IzKx3S^bKF|yB@XllJalXxTj-MFCi{j zmEcguuzQQ$zywxt(I_hln4=A4!c1CRhB)2G4uBF``Eq=ZnhZMYTJ}x8??Dc6#WBaI z_Od#DSC07v0#3u2Wj{b`k@RgFrBd}UXqmee{Dba#co>zmEX~ZuUX77FC79US;ZdfFc(cHR(XZa(fI+3h5PZm3qYT zh)KJN)+ge95eH$&T*V&58k8+GPQG16%3kn9#YjJDQ-R2GeJ&3uom7LVoGHlqm*m?k zAJ77YB(bmHrO_sznMIx7_#12qP6cVJr}9{$Zb)wN17+ERBcZwU0ju{g!3v)rArMes zK3_*)V5v(qvS#erp9As+jQ2iOqtmHa0lF-p%N)c@%C={%jL1dn#3eo&Tk^->-Au>3 zcxf+w5W0-g?O=9wiWv72{K|1R2aIe+0{`x}kejA~TA+X6e~6~~^x|go5;9vtkgp{C zI!E+`{4t7`Qgk-W>zD)!dG?U#_F!gOmkkMPzM$-4@J6=8hBA+0c*s_$-&oZJZ71}A2ZrJSA_7 z;=^CW8cM%3m{lI+58{WIQxb?*AxNdb=`6}KCkI#dDaGl&B27-j7>1Yfyos14DO(fR zC$gD-#VEEZS(84eFC{`i%QfXHe?F!_&H&m^fH5hZlQE5@uaKYNu{~FLD*4o@%cNOK z;o(AdIVVxQ#?7?GzzxWi2qRuhc1R<+aM^SUYDi&6SP@s0I{c+Tf;d@dE>f5}kj&H< z(kB&KUfdhbyi2jn$8L}O-j?Hob@XxW)V4KS@E=l=z#esN1DE|xqJ~j&51c>(2X-q2*_D`&9EQ+1gUl%2HPGe!2%cN3Sx zl5=1E40#l{uPa@sbKKdT-hbn}!7i8Km`%ukcZC2~x_0B*{#|LmQ~Xf6>vx(DD4@1@T7-JbV9S5ML@wg|jcpPC+5yq>)s{N5(4>b@OaEy!Coe70RLR*&gJSL|Io-eGx< zabb&V98xik{C=dh{b$H9n9KU?=?>}n&U2eszl6HdTRv8KXYq^gz%a*ja|IZ7vL?q;@M*SARr(xAXNCcS}K-Vo}us{AkWkwAlTpD|5@_={LH(Zy-!|W`<2$sKo|*M;BP(0W Y?@<4JIV9A7&I0>h1HbKR^?&yM4@J0vaR2}S literal 0 HcmV?d00001 diff --git a/Solutions/Cisco Firepower EStreamer/Package/createUiDefinition.json b/Solutions/Cisco Firepower EStreamer/Package/createUiDefinition.json index 97eeeac47e9..0df9ca78add 100644 --- a/Solutions/Cisco Firepower EStreamer/Package/createUiDefinition.json +++ b/Solutions/Cisco Firepower EStreamer/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cisco%20Firepower%20EStreamer/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco Firepower](https://www.cisco.com/site/in/en/products/security/firewalls/index.html) eStreamer Solution for Microsoft Sentinel works with [Cisco Event Streamer](https://github.com/CiscoSecurity/fp-05-microsoft-sentinel-connector) (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel \r\n eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cisco%20Firepower%20EStreamer/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco Firepower](https://www.cisco.com/site/in/en/products/security/firewalls/index.html) eStreamer Solution for Microsoft Sentinel works with [Cisco Event Streamer](https://github.com/CiscoSecurity/fp-05-microsoft-sentinel-connector) (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel \r\n eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Analytic Rules:** 3, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,13 @@ "text": "This Solution installs the data connector for Cisco Firepower EStreamer. You can get Cisco Firepower EStreamer CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Cisco Firepower EStreamer. You can get Cisco Firepower EStreamer CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, { "name": "dataconnectors-link2", "type": "Microsoft.Common.TextBlock", @@ -75,6 +82,76 @@ } ] }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "Cisco Firepower - SnortML GID 411 ML-only high alert", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Cisco Firepower / Snort-family intrusion events generated by SnortML (Generator ID / GID 411).\nSnortML scores are machine-learning probability signals and must not be treated as equivalent to a classic Snort signature true positive (typically GID 1).\nHigh ML-only confidence should escalate for corroboration - not automatic containment via BlockIP playbooks.\nPair with \"Cisco Firepower - IDS signature high priority classification\" and \"Cisco Firepower - Signature and ML corroboration\".\nRelated portable encodings: OCSF is_ml_only (ocsf-schema#1732), SigmaHQ/sigma#6237, elastic/detection-rules#6662." + } + } + ] + }, + { + "name": "analytic2", + "type": "Microsoft.Common.Section", + "label": "Cisco Firepower - IDS signature high priority classification", + "elements": [ + { + "name": "analytic2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects classic Cisco Firepower / Snort-family signature hits (Generator ID not equal to SnortML GID 411)\nwith high-priority classifications commonly associated with malware C2, privilege gain, or network trojans.\nThese events are stronger signature true-positive candidates than ML-only (GID 411) paths and may justify\ngated remediation after analyst or policy review - prefer HITL Gate/Prove over ungated BlockIP automation.\nPair with \"Cisco Firepower - SnortML GID 411 ML-only high alert\" and \"Cisco Firepower - Signature and ML corroboration\"." + } + } + ] + }, + { + "name": "analytic3", + "type": "Microsoft.Common.Section", + "label": "Cisco Firepower - Signature and ML corroboration", + "elements": [ + { + "name": "analytic3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects dual-signal corroboration on Cisco Firepower CEF: a classic high-priority IDS classification\n(Generator ID not SnortML GID 411) co-occurring with an ML-only (GID 411 / SnortML) alert for the same\nsource and destination within a short window.\nSignature + ML corroboration is a stronger remediation candidate than ML-only paths.\nPrefer Gate/Prove HITL before BlockIP playbooks. Do not equate standalone ML confidence to signature TP." + } + } + ] + } + ] + }, { "name": "playbooks", "label": "Playbooks", diff --git a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json index 28b684b3f05..8c24f7b0982 100644 --- a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json +++ b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json @@ -31,7 +31,7 @@ }, "variables": { "_solutionName": "Cisco Firepower EStreamer", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.4", "solutionId": "cisco.cisco-firepower-estreamer", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CiscoFirepowerEStreamer", @@ -52,6 +52,27 @@ "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.1", + "_analyticRulecontentId1": "bab70c8d-220e-46dc-aef2-1411eb43284e", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bab70c8d-220e-46dc-aef2-1411eb43284e')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bab70c8d-220e-46dc-aef2-1411eb43284e')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bab70c8d-220e-46dc-aef2-1411eb43284e','-', '1.0.1')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.1", + "_analyticRulecontentId2": "a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6','-', '1.0.1')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.1", + "_analyticRulecontentId3": "511445a6-6f4c-4e6a-a655-76c25b66597b", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '511445a6-6f4c-4e6a-a655-76c25b66597b')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('511445a6-6f4c-4e6a-a655-76c25b66597b')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','511445a6-6f4c-4e6a-a655-76c25b66597b','-', '1.0.1')))]" + }, "CiscoFirepowerConnector": "CiscoFirepowerConnector", "_CiscoFirepowerConnector": "[variables('CiscoFirepowerConnector')]", "TemplateEmptyArray": "[json('[]')]", @@ -71,7 +92,7 @@ "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", "CiscoFirepower-BlockIP-NetworkGroup": "CiscoFirepower-BlockIP-NetworkGroup", "_CiscoFirepower-BlockIP-NetworkGroup": "[variables('CiscoFirepower-BlockIP-NetworkGroup')]", - "playbookVersion3": "1.0", + "playbookVersion3": "1.1", "playbookContentId3": "CiscoFirepower-BlockIP-NetworkGroup", "_playbookContentId3": "[variables('playbookContentId3')]", "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", @@ -79,7 +100,7 @@ "_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]", "CiscoFirepower-BlockIP-Teams": "CiscoFirepower-BlockIP-Teams", "_CiscoFirepower-BlockIP-Teams": "[variables('CiscoFirepower-BlockIP-Teams')]", - "playbookVersion4": "1.0", + "playbookVersion4": "1.1", "playbookContentId4": "CiscoFirepower-BlockIP-Teams", "_playbookContentId4": "[variables('playbookContentId4')]", "playbookId4": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId4'))]", @@ -97,7 +118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.0", + "description": "Cisco Firepower EStreamer data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -478,7 +499,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.0", + "description": "Cisco Firepower EStreamer data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -577,8 +598,8 @@ "instructionSteps": [ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [] }, { "title": "Step B. Install the Firepower eNcore client", @@ -787,8 +808,8 @@ "instructionSteps": [ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [] }, { "title": "Step B. Install the Firepower eNcore client", @@ -840,6 +861,372 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "CiscoFirepower-SnortML-GID411-MLOnly_AnalyticalRules Analytics Rule with template version 3.0.4", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Cisco Firepower / Snort-family intrusion events generated by SnortML (Generator ID / GID 411).\nSnortML scores are machine-learning probability signals and must not be treated as equivalent to a classic Snort signature true positive (typically GID 1).\nHigh ML-only confidence should escalate for corroboration - not automatic containment via BlockIP playbooks.\nPair with \"Cisco Firepower - IDS signature high priority classification\" and \"Cisco Firepower - Signature and ML corroboration\".\nRelated portable encodings: OCSF is_ml_only (ocsf-schema#1732), SigmaHQ/sigma#6237, elastic/detection-rules#6662.", + "displayName": "Cisco Firepower - SnortML GID 411 ML-only high alert", + "enabled": false, + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\"))\n )\n| where Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\"\n or Combined has \"is_ml_only\"\n| where not(Combined has \"is_corroborated\")\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "queryFrequency": "PT15M", + "queryPeriod": "PT15M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CefAma" + } + ], + "tactics": [ + "CommandAndControl", + "Exfiltration" + ], + "techniques": [ + "T1071", + "T1041" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "HostCustomEntity" + } + ], + "entityType": "Host" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "SrcIpCustomEntity" + } + ], + "entityType": "IP" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "DstIpCustomEntity" + } + ], + "entityType": "IP" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "Cisco Firepower EStreamer Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cisco" + }, + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "Cisco Firepower - SnortML GID 411 ML-only high alert", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "CiscoFirepower-IDS-Signature-HighPriority_AnalyticalRules Analytics Rule with template version 3.0.4", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects classic Cisco Firepower / Snort-family signature hits (Generator ID not equal to SnortML GID 411)\nwith high-priority classifications commonly associated with malware C2, privilege gain, or network trojans.\nThese events are stronger signature true-positive candidates than ML-only (GID 411) paths and may justify\ngated remediation after analyst or policy review - prefer HITL Gate/Prove over ungated BlockIP automation.\nPair with \"Cisco Firepower - SnortML GID 411 ML-only high alert\" and \"Cisco Firepower - Signature and ML corroboration\".", + "displayName": "Cisco Firepower - IDS signature high priority classification", + "enabled": false, + "query": "let HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Known malicious file or file based exploit\",\n \"Known client side exploit attempt\",\n \"Large Scale Information Leak\"\n]);\nCommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\")), \" \",\n tostring(DeviceAction)\n )\n| where not(Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\")\n| where not(Combined has_any (\"SnortML\", \"snortml\", \"is_ml_only\"))\n| where Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "queryFrequency": "PT15M", + "queryPeriod": "PT15M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CefAma" + } + ], + "tactics": [ + "CommandAndControl", + "Execution" + ], + "techniques": [ + "T1071", + "T1203" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "HostCustomEntity" + } + ], + "entityType": "Host" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "SrcIpCustomEntity" + } + ], + "entityType": "IP" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "DstIpCustomEntity" + } + ], + "entityType": "IP" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", + "properties": { + "description": "Cisco Firepower EStreamer Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cisco" + }, + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "contentKind": "AnalyticsRule", + "displayName": "Cisco Firepower - IDS signature high priority classification", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "CiscoFirepower-Signature-And-ML-Corroboration_AnalyticalRules Analytics Rule with template version 3.0.4", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects dual-signal corroboration on Cisco Firepower CEF: a classic high-priority IDS classification\n(Generator ID not SnortML GID 411) co-occurring with an ML-only (GID 411 / SnortML) alert for the same\nsource and destination within a short window.\nSignature + ML corroboration is a stronger remediation candidate than ML-only paths.\nPrefer Gate/Prove HITL before BlockIP playbooks. Do not equate standalone ML confidence to signature TP.", + "displayName": "Cisco Firepower - Signature and ML corroboration", + "enabled": false, + "query": "let lookback = 30m;\nlet HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Large Scale Information Leak\"\n]);\nlet Base = CommonSecurityLog\n| where TimeGenerated > ago(lookback)\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\"))\n )\n| extend IsMlOnly = Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\"\n or Combined has \"is_ml_only\"\n| extend IsSignatureHigh = not(IsMlOnly)\n and not(Combined has_any (\"SnortML\", \"snortml\"))\n and (\n Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n );\nlet Signatures = Base\n| where IsSignatureHigh\n| summarize SigTime=max(TimeGenerated), SigActivity=take_any(Activity), SigMessage=take_any(Message), DeviceName=take_any(DeviceName)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nlet MlOnly = Base\n| where IsMlOnly and not(Combined has \"is_corroborated\")\n| summarize MlTime=max(TimeGenerated), MlActivity=take_any(Activity), MlMessage=take_any(Message)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nSignatures\n| join kind=inner MlOnly on SourceIP, DestinationIP\n| where abs(datetime_diff('minute', SigTime, MlTime)) <= 5\n| summarize arg_max(SigTime, *) by SourceIP, DestinationIP\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project SigTime, MlTime, DeviceName, SourceIP, DestinationIP, SigActivity, MlActivity, SigMessage, MlMessage,\n HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "queryFrequency": "PT15M", + "queryPeriod": "PT30M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CefAma" + } + ], + "tactics": [ + "CommandAndControl", + "Exfiltration" + ], + "techniques": [ + "T1071", + "T1041" + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "HostCustomEntity" + } + ], + "entityType": "Host" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "SrcIpCustomEntity" + } + ], + "entityType": "IP" + }, + { + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "DstIpCustomEntity" + } + ], + "entityType": "IP" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", + "properties": { + "description": "Cisco Firepower EStreamer Analytics Rule 3", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cisco" + }, + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "contentKind": "AnalyticsRule", + "displayName": "Cisco Firepower - Signature and ML corroboration", + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -849,7 +1236,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepowerConnector Playbook with template version 3.0.0", + "description": "CiscoFirepowerConnector Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3542,7 +3929,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.0.0", + "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -4777,7 +5164,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockIP-CiscoFirepower Playbook with template version 3.0.0", + "description": "BlockIP-CiscoFirepower Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -4853,7 +5240,7 @@ ], "tags": { "hidden-SentinelTemplateName": "BlockIP-CiscoFirepower", - "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelTemplateVersion": "1.1", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, "identity": { @@ -4891,6 +5278,11 @@ }, "actions": { "Entities_-_Get_IPs": { + "runAfter": { + "Gate_Prove_ML_only_deny_auto_contain": [ + "Succeeded" + ] + }, "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", @@ -5423,6 +5815,156 @@ "method": "post", "path": "/api/fmc_platform/v1/auth/revokeaccess" } + }, + "Initialize_Dual_signal_context": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "DualSignalContext", + "type": "string", + "value": "@{toLower(concat(coalesce(triggerBody()?['object']?['properties']?['title'], ''), ' ', coalesce(triggerBody()?['object']?['properties']?['description'], '')))}" + } + ] + }, + "description": "Concatenate incident title+description for dual-signal Gate/Prove (ML-only vs signature/corroborated)." + }, + "Gate_Prove_ML_only_deny_auto_contain": { + "actions": { + "Add_comment_to_incident_V3_ML_only_deny_auto_contain": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Gate/Prove: ML-only - auto-contain DENIED
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Terminate_ML_only_deny_auto_contain": { + "runAfter": { + "Add_comment_to_incident_V3_ML_only_deny_auto_contain": [ + "Succeeded" + ] + }, + "type": "Terminate", + "inputs": { + "runStatus": "Cancelled" + }, + "description": "Kill-switch: do not call FMC BlockIP / Network Group APIs on ML-only incidents." + } + }, + "runAfter": { + "Initialize_Dual_signal_context": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "gid 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "snortml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "is_ml_only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "ml-only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:ml-only" + ] + } + ] + }, + { + "not": { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "is_corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "signature and ml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid 4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid=4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 4110" + ] + } + ] + } + } + ] + }, + "type": "If", + "description": "Gate/Prove: deny auto-contain when ML-only (GID 411 / SnortML). Signature or corroborated incidents continue to BlockIP." } } }, @@ -5488,15 +6030,13 @@ ], "metadata": { "title": "Block IP - Cisco Firepower", - "description": "This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry.", + "description": "Blocks IPs in Cisco Firepower via a Network Group object, with a Gate/Prove pre-check that DENIES automatic BlockIP when the incident is ML-only (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not treated as a classic signature true positive. Signature or corroborated incidents still block.", "mainSteps": [ "When a new Sentinel incident is created, this playbook gets triggered and performs below actions.", + "0. Gate/Prove: if incident title/description indicates ML-only (SnortML, GID 411, is_ml_only) without corroboration, comment and cancel - do not call FMC BlockIP.", "1. For the IPs we check if they are already selected for the Network Group object", "2. For the IPs not already selected for the Network Group object, add it so it gets blocked", - "3. Comment is added to Microsoft Sentinel incident", - "![Microsoft Sentinel comment](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/Images/BlockFQDN-NetworkGroup-AzureSentinel-Comments.png)", - "** IP is added to Cisco Firepower Network Group object:**", - "![Cisco Firepower Network Group object](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockFQDN-NetworkGroup/Images/BlockFQDN-NetworkGroup-CiscoFirepowerAdd.png)" + "3. Comment is added to Microsoft Sentinel incident" ], "prerequisites": [ "1. Cisco Firepower custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc pages.", @@ -5513,9 +6053,11 @@ "6. Repeat steps for other connections such as Cisco Firepower (For authorizing the Cisco Firepower API connection, the username and password needs to be provided)", "**b. Configurations in Sentinel**", "1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.", - "2. Configure the automation rules to trigger this playbook" + "2. Configure the automation rules to trigger this playbook", + "**c. Dual-signal / Gate-Prove**", + "Do not attach this playbook to ML-only analytics (SnortML GID 411). Pair with the dual-signal analytic rules in this solution. Attach auto-BlockIP only to signature-high or signature+ML corroboration incidents. ML-only must escalate, not contain." ], - "lastUpdateTime": "2022-07-20T00:00:00Z", + "lastUpdateTime": "2026-08-16T00:00:00Z", "entities": [ "Ip" ], @@ -5529,6 +6071,13 @@ "notes": [ "Initial version" ] + }, + { + "version": "1.1.0", + "title": "Gate/Prove ML-only deny auto-contain", + "notes": [ + "Deny automatic BlockIP when incident context is ML-only (SnortML / GID 411). Signature and corroborated paths unchanged." + ] } ] } @@ -5555,7 +6104,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.0.0", + "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -5647,7 +6196,7 @@ "tags": { "LogicAppsCategory": "security", "hidden-SentinelTemplateName": "BlockIP-Firepower-Teams", - "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelTemplateVersion": "1.1", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, "identity": { @@ -5684,7 +6233,150 @@ } }, "actions": { + "Initialize_Dual_signal_context": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "DualSignalContext", + "type": "string", + "value": "@{toLower(concat(coalesce(triggerBody()?['object']?['properties']?['title'], ''), ' ', coalesce(triggerBody()?['object']?['properties']?['description'], '')))}" + } + ] + }, + "description": "Concatenate incident title+description for dual-signal Gate/Prove warning on HITL BlockIP." + }, + "Gate_Prove_ML_only_HITL_warning": { + "actions": { + "Add_comment_to_incident_V3_ML_only_HITL_warning": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Gate/Prove HITL warning: ML-only
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + }, + "runAfter": { + "Initialize_Dual_signal_context": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "gid 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 411" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "snortml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "is_ml_only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "ml-only" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:ml-only" + ] + } + ] + }, + { + "not": { + "or": [ + { + "contains": [ + "@variables('DualSignalContext')", + "is_corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "dual-signal:corroborated" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "signature and ml" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid 4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid:4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "gid=4110" + ] + }, + { + "contains": [ + "@variables('DualSignalContext')", + "generator id 4110" + ] + } + ] + } + } + ] + }, + "type": "If", + "description": "Gate/Prove: warn HITL operators when the incident is ML-only. Does not auto-block; Teams confirmation remains required." + }, "Entities_-_Get_IPs": { + "runAfter": { + "Gate_Prove_ML_only_HITL_warning": [ + "Succeeded" + ] + }, "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", @@ -6649,9 +7341,10 @@ ], "metadata": { "title": "Block IP - Take Action from Teams - Cisco Firepower", - "description": "This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry.", + "description": "HITL BlockIP via Teams Adaptive Card. Adds a Gate/Prove warning when the incident is ML-only (SnortML / GID 411 / is_ml_only). Analysts must not treat ML confidence as a signature true positive. Teams confirmation remains required before BlockIP.", "mainSteps": [ "When a new Sentinel incident is created, this playbook gets triggered and performs below actions.", + "0. Gate/Prove: if incident title/description indicates ML-only without corroboration, add an incident comment warning. Do not auto-block; Teams HITL continues.", "1. For the IPs we check if they are already selected for the Network Group object", "2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depending on it's current status block it by adding it to the Network Group object or unblock it by removing it from the Network Group object", "![Teams Adaptive Card preview](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Cisco%20Firepower%20EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/Images/BlockIP-Teams-AdaptiveCard.png)", @@ -6666,7 +7359,7 @@ "1. Cisco Firepower custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc pages.", "2. In Cisco Firepower there needs to be a Network Group object. [Creating Network Objects](https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/reusable_objects.html#ariaid-title15)" ], - "lastUpdateTime": "2022-07-20T00:00:00Z", + "lastUpdateTime": "2026-08-16T00:00:00Z", "entities": [ "Ip" ], @@ -6692,7 +7385,9 @@ "5. Save the Logic App", "**c. Configurations in Sentinel**", "1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.", - "2. Configure the automation rules to trigger this playbook" + "2. Configure the automation rules to trigger this playbook", + "**d. Dual-signal / Gate-Prove**", + "Prefer this HITL playbook for ML-only analytics (SnortML GID 411). Auto-BlockIP (NetworkGroup) must not be attached to ML-only incidents. Do not treat ML confidence as a signature true positive." ], "releaseNotes": [ { @@ -6701,6 +7396,13 @@ "notes": [ "Initial version" ] + }, + { + "version": "1.1.0", + "title": "Gate/Prove ML-only HITL warning", + "notes": [ + "Warn Teams operators when incident context is ML-only (SnortML / GID 411) before offering BlockIP. Does not auto-contain." + ] } ] } @@ -6723,12 +7425,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Cisco Firepower EStreamer", "publisherDisplayName": "Cisco", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco Firepower eStreamer Solution for Microsoft Sentinel works with Cisco Event Streamer (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Sentinel\neStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

**NOTE:**Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco Firepower eStreamer Solution for Microsoft Sentinel works with Cisco Event Streamer (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel\neStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Analytic Rules: 3, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -6760,6 +7462,21 @@ "contentId": "[variables('_dataConnectorContentId2')]", "version": "[variables('dataConnectorVersion2')]" }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_CiscoFirepowerConnector')]", diff --git a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md index 2565ca59f60..f03eb58f337 100644 --- a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md +++ b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------| +| 3.0.4 | 25-08-2026 | Repackaged solution (Create-Azure-Sentinel-Solution V3 tool) to pick up the 3.0.3 dual-signal Analytic Rules and Gate/Prove BlockIP changes. | | 3.0.3 | 17-08-2026 | Dual-signal Analytic Rules (SnortML GID 411 != signature TP) and Gate/Prove BlockIP (deny ML-only auto-contain; Teams HITL warning). | | 3.0.1 | 10-07-2024 | Deprecating data connectors. | | 3.0.0 | 26-09-2023 | Addition of new Cisco Firepower EStreamer AMA **Data Connector** | From 88c8bdc4d5cad9952e0b05123fb100495dfa1858 Mon Sep 17 00:00:00 2001 From: aah20 Date: Thu, 27 Aug 2026 11:05:59 +0300 Subject: [PATCH 5/6] Fix Firepower GID Kusto validation and repackage --- ...oFirepower-IDS-Signature-HighPriority.yaml | 5 +- ...epower-Signature-And-ML-Corroboration.yaml | 6 +- .../CiscoFirepower-SnortML-GID411-MLOnly.yaml | 6 +- .../Solution_Cisco Firepower EStreamer.json | 2 +- .../Package/3.0.5.zip | Bin 0 -> 45446 bytes .../Package/mainTemplate.json | 76 +++++++++--------- .../Cisco Firepower EStreamer/ReleaseNotes.md | 1 + 7 files changed, 49 insertions(+), 47 deletions(-) create mode 100644 Solutions/Cisco Firepower EStreamer/Package/3.0.5.zip diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml index b603d6f41c9..bdec89f27f9 100644 --- a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml @@ -51,7 +51,8 @@ query: | tostring(column_ifexists("DeviceCustomString3", "")), " ", tostring(DeviceAction) ) - | where not(Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411(?!\d)") + | extend ParsedGid = toint(extract(@"(?i)(?:gid|generator[\s_-]?id)[\s:=]*(\d+)", 1, Combined)) + | where ParsedGid != 411 or isnull(ParsedGid) | where not(Combined has_any ("SnortML", "snortml", "is_ml_only")) | where Combined has_any (HighPriorityClassifications) or Activity has_any (HighPriorityClassifications) @@ -71,5 +72,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: DstIpCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml index 79366026477..24b0e914650 100644 --- a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml @@ -50,8 +50,8 @@ query: | tostring(column_ifexists("DeviceCustomString1", "")), " ", tostring(column_ifexists("DeviceCustomString2", "")) ) - | extend IsMlOnly = Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411(?!\d)" - or Combined has "is_ml_only" + | extend ParsedGid = toint(extract(@"(?i)(?:gid|generator[\s_-]?id)[\s:=]*(\d+)", 1, Combined)) + | extend IsMlOnly = ParsedGid == 411 or Combined has "is_ml_only" | extend IsSignatureHigh = not(IsMlOnly) and not(Combined has_any ("SnortML", "snortml")) and ( @@ -86,5 +86,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: DstIpCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml index 96dd3e577c7..8503ab631c4 100644 --- a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml @@ -37,8 +37,8 @@ query: | tostring(column_ifexists("DeviceCustomString2", "")), " ", tostring(column_ifexists("DeviceCustomString3", "")) ) - | where Combined matches regex @"(?i)(?:gid|generator[\s_-]?id)[\s:=]*411(?!\d)" - or Combined has "is_ml_only" + | extend ParsedGid = toint(extract(@"(?i)(?:gid|generator[\s_-]?id)[\s:=]*(\d+)", 1, Combined)) + | where ParsedGid == 411 or Combined has "is_ml_only" | where not(Combined has "is_corroborated") | extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP | project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction, @@ -56,5 +56,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: DstIpCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json index 161f3b615e9..0107646e0ab 100644 --- a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json +++ b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json @@ -22,7 +22,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Cisco Firepower EStreamer", - "Version": "3.0.4", + "Version": "3.0.5", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Cisco Firepower EStreamer/Package/3.0.5.zip b/Solutions/Cisco Firepower EStreamer/Package/3.0.5.zip new file mode 100644 index 0000000000000000000000000000000000000000..879a41193124134315d0f6470ab54235b789e7c6 GIT binary patch literal 45446 zcmV)TK(W72O9KQH000080MtqwT~}MtB zX>V>WYIARH?OOeA+sG0BKTokxT3AX&$#(9N!f5WG`Xe!5UtG(*ps<2qMXsbxNG^}N zvZ6~3^jZ37eUkoWmt0X4paVw0SmozLIQ?E1q4##(>S;Y=jFb--FPV={fv z@4Gj>gr|He5|Nr7|9PH^UZ|4do9^%S_Imq4mWvxH7X8Cqa3lVHdL$+?l}4(xcRr7e z{4wdh)hd11>e5y-o<_0AX{&P?=1QxH=?yIF3Ij)bBXSKkM7y??`3;UUr*EdC7F)>3 z%&^1LZ?pG!oC!Id8UOs^Db9{r$;yN z_&Y?U?(0H;QUPtL9dU(x-8o?VzOzw9!Uj(*tJ!Lc~w@TEEbEN zb*jq>X+&S9eUbLFTt)NHkd)y(muA_YVD$owH7FwSzBe;T++m_LiI)!E%$ZLNR+^bD zRQ^sQR?MuF=lBNSSjnK#VU}>{MaY8PZ-b=d9h4Rf5XGqojmkT$jTBML8J_Evd>w|g zWt;*{v!$Ao*|hz}hD-Q9f#FO(*VeufZHwGp+C>F-(kuhFoVOMh(!q3P|%hQh8g9Eos}KoXwD8}X>B8NNWlgdr(mJwGzBj*FU5V$r|gI4 zC$GE{dK8EirlI4Pi=Pl&MuQuID+V`VePGpsdSfx;@r0>~-C=lod`?;*-=`FZKGS6C zBv46$C+Ef!l_%V=_TlkK#|9oGfGVpsv}q;~Iv`ft8TbW+Ol1NP?ePh_k(>?A2h6*h zEE)nl@L-7`sdlOpxo5SIaZLGGqz2SRWB`1P({xQtN5ZWU3*>rvb$q}cJzBXg7l=(b zJko3Q#H}jkVJT+ejrUR;QpbxAPa|RZSj`P-0tsOvFh>oE*m%hX^C^40*Jb;=``;A8 z9FeCyV@-&<--U34l*daWLv}fjg?;^)ULVf2L9klHW593_46;nuIP4MWMa-9DrQW&4 zwA=NW;Cadt<%Qgg-VIc!_u7G*EfD0Jz==ee3^b;&J)9~Y^FkHG8- zmj~6K1(-imZ53#UiJ770Ko;Z0OvRCF z`iIsjDALXQ);u3!yNH?*TZCfrwMyek7*wJ_e_9xzeL;aVx-msW^dpbqX6v?uXKfdP zZI=w~o%Mj<>GW=hyvqu@4tw@pS%P)js59y@if{0Dr_0KBjUm?oK^xsxdYSAuY zXXnGn*?ZJF7`1k~jL7V&F54Nkx}%nrr1|UZ4p_fl4^9eabV1Pu7*wpaf}IM9i>=oM zN}vbKJ^~Vin5*L57(li9T%{SuJQ7#ZSTXJ*gtw^@)k{|msGEh_3ygSg>J?;bGF*Z9 zuR!>B^%W{}HLzYEh#75AhWD`6IB6Tdwx3*eY1FdT+f_eH_1HhqjfXt7#bqm5(JYp; z04kx|1sQ{Ge*45h(cNQ%3H9Y$#>y^pLpSwE)bERwBUW5vSknafy&6`ha~bh8q`tBk z0#-~X8zu+AZ*_Qm<)T3FKraZh`sck`IS8Wd@$F#`FBkNhcQH1-> z0KtSO5?cEcPJni|LtF_jx$5ho-U zN1h~{pr)9M?2#`W_F4CwUa+h@Lc?wsT;}eyd(;qjr$@tz>^9o6Tq|h8KpKK$e_U%gF*_c z81}(y6-pbuc3HyX1p&(8ewW;FBV&OoKSdsP>5?K9hQ|wX*y1 z*DU#WD*0tI`tkoZqa!3@;A(8GqTyfNGKa?}2bKD|o}~ndwYrpUW_~^4v1y<}%=I}H zejBq5Sycke`B}$BsK4UWFy|;OjzY;>k)UILUR>&7jz^+V{l*%M6_Hv{590m%rw#AA z%ThpPW^QrkzS#hx6oeTtBcRe zuumF{y{wIc@kP_uUpN>y?etlLaiegbHW+)EeiMUnsnBW?rofnqIAano+#eU%)3EZG zjJ?d!sL>688;l3OMA$^R6gq=AXoQC^2bUeD{7vUaM{HxuW_e{Ei7Zx2)S`JBVU-v3 z$_rXtSyTkD&a#vE#?hU<318YnK`{5Hb5T)J-Cs-i+r_3yp7{ns% zdmij_8x4`4>`Se`(rmv8L-uER(W2%io3Gtkt#0sw%7u07dLnae+Q0Df3K7-*j0>!; zZDV!0!rnlY+b>o-*KWG(ZB?m5^`@$|rdavVu2QV76N#i@ui{#ita@ z6aWAK2msVd8(l#W6;=SH008?d1^^KN003=aX>L?yZE$R1bY(7Tb8l|!eQ8_jNVn+s z_gCcF=ecStGK22(cE62)h$13`sC)0n6Osa=A%P4a_UZfEZ&hU=^8`3-lkTS*lNwj8 zwQ7x3fB%ahcK%DG#$ZD3d?R+ok~9^+C6mgVqY258BQOD+bVR<&0yv`hiTX`UW>V>s zL@Jj^rIR$6viuU2>w?LYB_(k5B=X#EJBO%!isvNw=@tkg!*i&c^ic}^qkNtKiKIyh z_5U~g8@?fBY0L|#V3`pq9v8#yOi&jh`q1H7S%R$*lG-6L3H}O?d;~Ny{lf9f^{_a3ggHXtWI10Nh9#!;fkG zEe(dG%u2T;E8|+<1t9XWK!KXT%hSF6Bdv>{hL)`JR$CG&ftjkq*=h0;A&Y=MBnGlX zZ~)MNCM2GilA=hE!XzO{&kzQpMEp-f?IO_`^D;{(VAaGaNSu=bP4TeW{~QrS9}o;D zN`RzMtAsQL#Q!XK;aQxL6i8@;{2yX5W~ed2hy)D;W)8a?3j72YZDyI1P4cm5x>EYh!RJ#ONpUGxOzYU#1%sc zyvPqFq64Xh;Q)&kR0NVdwah^$jyWkXt?&9!_jXrbcK0><+L4(u&kdPTolfhc)(34Lv!%GP zdBZ0|`)HNmdk&%tFO(Gy7qBmns>Xg@in)zJYXQ8#f(Y(y72oUhp0N74tE0uy^%Mvg ztx2{HYmCN{nAGuD+&v_WB%ptQG;l~5TIm2v78q%%H(?qTYQ``px4C1&a)gf`U_2nA z?M0m_pb++^jf}!&Zil-`kE!h*`qfU*RATo~=9rlb6yn|sHvN5V$twcTp(=dz_bC^$|aqk}P($p^gK`6uTD8pCVaIKE3R*Yj&S_w35r9Zc| z)#h#n&x#&19@JKX0*#%xGw#Hl@g?q{-FejZr*GF`Xf1q3`p$UKw>MxsAY!HO%txi~ zj6Z#6Leh8U6VP`iAbnfFL#lF2TV}!a;0cyY8-*(4XDf5etR$&NV>!yS$qvXtF-0BI ziA*L161f6gQW6X^iF7WV27_ESbDRUKhK%iKeASuWZ0J;CfgquJ8m1y@*$vYD3gs;$ zc$Ynm6s$NOa1#5*X*jLOTKg3#M8;=bRz_n{S_w8KrNdo}Y|8vhYJeSgGd{SR35>hA zB$=j8Kq^y6oD2rVM2^a35@eQ4Cyuj2lFU+Mra%_la5u9)?gr^TFz&tyzjnagV3P=r zyHR-YhH*F0ltSZf)(3a9fpHg?%%{`2T%If>3d0WK#`A zs*|a-EC~X+#BCr$=-%%4pN5jK*mA)0&ld5;`q|5>V4sI`E#nmIB^<`|E&>MYDO5X+ z+bA&VZLKsS8@HHvYDN7ZTG3A%s5c?Ru+fF`20vn`(sU}8Wl`cM9`d;p1Z|?Z6)Vj^ zHlttSl;x@CvztmY(F78L5;k<(@zkxLGxd2i>rRU6La9S;Wi94KS`JP65tgNjJ6WmHVA_?evSDZ7+=3@jWgUsiOL`1PRM{Xz^(Mk$NTSLH zB&sL^;oA^Z)}N@dfrzRL$cgBIi^_K&GSV9fKtH&wJK^N~2qzbKu+CLIDJJJgF}aOV zOfCq;2^#}ks zo9}qSwy=bt-jn21;O7ht`$?*x(rpa}1HzOs_`ox%Oje1PNlXPWXTV}rl2e`Qu5J*U zT4u6T7y>PJzB>{?Vim$*s7He-;Aruh(*c5CzrT-3LqC#wCP%>PWHKVbDj?&hJ}tO5 za99#!h+|NvYl@?AjbtDY=m|=LJ+WY<@hZ@0t}H2GjA_8lPe_K-*2&cI_G7H{ekfb4 zl`BfE^t_+uHq0SX|Cqj+B1Fue?9`<_f1Ca?qWgLrKU`pep?@1;rW2{G6JhE#*5D6j zf2qCch{UVce`Yw$o@;;u0z>uc_989>VZ<6`csKWNg7VkB;FnR_HMjt1Ng0 zKoG;p0Q#pbS`X;-H)lwq0Y)UXBuXQ=kj|}6R)#W9URmKgM5TLL?$4+ro7Ql6* z9Ren_xGp$o_u2ze1ZdRQf~w3}BY!A-{^0&s4RNbLYNfy}>B{4z9I=(F^CLc%Z7vowjf!Sz`{L56}--NmZ8_5y#yHHp1cEtiUMpc8=$0UIElUGl=4hf121HjN zheL)UTD%|;$ElA3nhNA~42L%>JThGHIJG{dA->avn{Wgw)1(a>03hphWlsAZyp0qk z6cE!^x!{{{DpXFCClk2yz5=4lOaSo*F(F^}&`-SeqfK>x)f^*oJd#64)!bRQ=@C~^3uzhXmUDp6gT*!k?7^Vr! zT5JDFkRyICo1$G-2d>4Mt47YD&_NCu7Q)3vs6*SBL`pJR%(U|=>@Z?Wm5jd;Ly{GN zLorA0wgctP2_qs=+gbL+g*4Tnr3%d+tL=tZij=F>4lJj;qMdo@6-GpclP*+@QR@Oq zpdcY9ULZms3O%i0_ z-Y{~#qWK3YNCOt=C0z?T;Wd8m*7k<6At{dG`q7tQxej6&(Lv$~rA^`)HmYk9dY5K= zA-;Ejl9faAl#FzJB`pQE!U9s@hzSpilTZqf3{9Yxf9`2!1z1x&TDiNCH38cdl>a6m zpJbq-mqZo>I2!m7DOiaGR3iC>_!~cfS_+p~sh$j-fQX)eeYoft7I0h8*$CW!P=8qNd5 z1`;C$DHd{YQU%|Hq{eW99yn-U62Hb2_&8)^VZfj?JW|9Ufh6>@gpiUJ0C38}iK83^hx5x>@3gB|0pGWkrVKy=G3mHN_0 zQ0sh#l%$NA#I#O~$vGfeOKHq=`ee1q$RYv+n#GVunmhUnCDp=7d?ThxorG%MRy)ZY z5%;jwi7ZM=(-7I`NXj+sa(kjo^ZVBRy!Hz-Z}g^XKODoYIppoYiw*Slx6 zyuLrx-K}1x3N3+wI>QoffbK-4J&v-wr9CLc0~TR=TjreC5aAtT*dNI0lwI0s?OTBH z>q^%ST3KQ-0uqt9CMYm`RC@rz(R4{@LWe*ujz$og@&NKPEm;N29+=N4|4nFAkeon0 z2nb12R*9H|qfAt>JZaz{dCh@1f90t;6xFOal5ROfuqACJRdTy;F+4IEMDRXN<+!yQXmUIS|B$92HgkXT^qP+xP@rJza^ zm{C9#0~rd5y(73N2%<;g7=PJEjQ|ddntEgeT5eUs-GlJKPFaW zQ`^Og98uOcPzA!+LWIYwsL$$Rk*;oUcRcWJ82Qwp@}PCF;__HAI#e`B5g#3cSCm6y z5d66$)MHEzi7|xx98o?=(~M$7!>Wm5Hc&dlyj5vz%^&j9X(sJrj(w zi$PIXGrOy9mDQGKcloJNS6I8POHfsX%oAzRicvL_A|M9KkmbQW5HdsDh=JWHI4XjD3nP+aUX@5d(YR$ov3~gjlkxY) z%1`v?YGWgx$)kyw#EcMlM>pt@$sG|&c{5`P5l3KqXDwy^+X7x&)aV*9nEJVD{-L05 zG1_{K4F#{NwarJXpn!H1Ua}`np&;&lw2Yd;nKVW38^-7t@CnC^<70O|>xn|nfxW8$ zX!|K~?hQG%qea!4mdB~!e2q|RwFw2(ZZWsoNVGsx=SWXI$jRq;KF6*dpk+Q(&rZn> z)6kFYbex81fWaCRwBbGF(y}OcJgJc)>!u z!z8@XO~2e$zBWtn+q&1-vYoeT?=3py)*O0EHf|t}Td>>K zYpm$J)p~5Po?Gh%w$y(-8Pq!^kOfa1+d{%vWX|E9Am++c{1U=8o6+T$$@K*@xV$sB zY^rhiOs!}cTJM#aWfGmusNtFy;+l23W**2dk^kWi&|rBUuErVPybh0ij$bg3<7Ysq zdnXdwpdB%B@M9(n`q}*=BnE!)gusw94wd-#F%$mWG2b&o$u%>{Gb71-E`e7DQjp9e zC-doMGL5#AVH72^C|Djwi2Mt`3?kpmA)kyPo2AX##)ekSJ0mF01abgxuneHhW1M%U zkGE;|rz`jH&EWB4-d`zW$1hISaoyI>%=uawIS!r@Ke%or^Cr%?`J@>)!GdsHqZk4P z-vkZ337kn2D1*i$Fz0PDW`2=O8P{-}FrhfnfwX11)iQ*R`LCC*&g zQszo%0bzp~Dsg7Yb}~~Utm(!xP~yy!x6V9?u<9GgFo`ouzEWmM2yrY*21!`sew-=t zwK7Hgl~YHK7eFZuqLBJ$fVe1_Tg&+PbuvAiPecl+PKMx0K{7Z(a-k2MsSz?m!`<`d zf0*;Xtc`3uT=ZQI&(Fk%=f{WVZ{+a&%&&ZSekMLVpKvD#Bi3x-@O&F4t)Len)UtF{ ziqFiC&&)T5{t*A`6#Dc32<6hMU26e7@CTOAM}kTb|BE*`sFg!_J`R?TR-PhQ0gb3B(&qE>IOMC9iMOM_QP`BD-nE!+YqOiK0t zLhM>uz(eB;MibHeGNIs(+S`95av=UuYF}Y5bPMgzoiSk9!`08ef@StMaL|Y4MqT^9 z`UyX{?u}8ng3Z(J7WJ(fbua+cU^wlS+1@HDD=+{Cs5=50Q?MhXwTPpn+Gv6T!vvH* zeuK2ZCEzNrLXi?v2y;x4N~AUZN>hS6keo3%@czC2g&J>vBAqdu5uH=QE><5|e_a zVfQncSJm%$xWHfuHa+XWQJX~R$PilMX;^bX%^>H_TL|K@38mm~2^@~A`^i;C1QDC( z5G)ZZQo=+rsf&-uy#`_3BBOjuAN#jD#D^Lg3<11tll|YXFeH5?EhAR?SMeZH#v@XJX!jqjN(to4{;carG!%UHOgzgh-ayS9cXP;$a0lTAs2>q#>F*DWbq195zIv zP))=_)e_VaqfG9I(46_23ttr@^c)z3ht9}NAWmo}W5-;JAorWt2^$l&`^5sv<9pLV zXtF;I7W5OIw!d!hwF7JdUN8`59nEVA`QgUy95A#W$8c}=_JP&oOWEiNixqGm+wj!{ zhF;=O@U31_uzI$F8c-tH(hUZN-r|Vzce=}9^=t)saz~rH=)ll^9GL!v0@Lk}*Nt1s z^Y-F#**W?&yg2+ZBi}zu;QJfIy>I1$1Oq;Vx(_iZw&IpU-i@f%+V-6WhOV4*s5K7q z2(|6)#=a{S)udO4<~VrIp(T*PGzdQnxcP=l!nSm9Pi)IgN1D z!#3i3K6DTjSX&n#Wyy@H#Xpr#5XpC zrPnvOvB8}Eu;xV#*5QY}sKHu4Ecf}B5f$T$8vHiYC>J$k;)@!h?BHv2f=yo3U~N0T zs6qSmH7;t%#1}Pe?4ky1_F#NJ!!L6`!>7yw{Is_}#JNUMa*aOC-4t=oP<-`8eDy_q z^+kO3MSS&zsc3xl#h1!D``lMwSh$OO)|dlc#aUuOv&4c>>6gg{+ur3X+dEBids$pz zvbQ{P3EwVTE6&o2v$WzYEeCGn77Z08HF(2WSaJ518(CCw_SCksr#7I=;&fojnvXYbfF^ zBAL&9iwLQ1LCF4gJwVYA>D~P!<6G<1BI)>Ikxg7IqU))N4hQAUt45+$ujJC{#8u;( zW0#MbY(TPT5k!Nmfd2k_h={ZnMSxXzfCP32sOsH74O1ad zz%JC$umXsMMe7{)$EBby2gk9TBchS(a1 z#Ooal9j8V*dIP8g1iNX}KX%|K+JIHWaO5{ZIxy1ikz62tBd*JxGpHm#PS{5bl0B%U z4igIR`7K?{W*`HHT};UHo1}>T|63uGEgnMI9txBU1zD1$=rsuevCZEKg+j(Lpuv)R z;+7mrgpc6*fBq3%V^W071A@yG$8`uRs)COeM5w$x z>sFK>DEj=z&OT~ZjnIUn8ZaCVgoN@WN@!35TqPd<3D;=v3Wy@y9rjUm`0t_Rb4j~Ns zkBOiEVd#DI^V=Ukf8YD@gFe_teWVX{Y}(&nVXmQ*KQLwS!V2pkBEzw*7=RJwA-~(R z7hLfdK$}q+1raL~uR<*m1#qfVgNPoo5rL{tE#EtesM$IsDxzfjY6yp{w@^n~0I?~y z_|V+Tszqb%Lu+j1p&n;?XbP=WSJ+MphlEOrhlCT&9onYvFk^>l{&2E^DNO4O=b>;E z=3cFCI)CL_v<2YCL3@@Hk=<1Z3*ET_G$T(OOUctI@+HA3Rn(XWwbgT<;#FTx45?u> z0)nDS;8eAp8s6iD?wE80gIc3I7Lb*JMUAJNMxn*E?v#}HSJpH9&1?j5F)6vk?D$_% z;}qB*?jl&->8K=scqWB^P1 zbmHC-ZUTv#$iu1x&7R3Di=`nC)2Fh%Xfl(P!EEV7^gy7hx84j;{@!g1oNR1229#F8 z3@F=Xv;jcbN%mh}B|gS^KUkH2!}ET0;}SAFxF1j8Z>y=(=`~IO3VZ>t#Te$qv(1MQ zgq=jVV|>=M<`}FqriBP`vQJbin%Zi7*iU@e4<1Q;*v|&2+Is$v8&PlA2IYGSQ1A)q zO{9Ge23otx4e+zi?{drdxZE5>W&ir*E%&+6*8|lg6qikX#Z^P&H+S%OBhb4^x1oN;8T#jvT@zBQPF` z5*nWp!a^u$0k?99AVXNgpqfbEvWSeK`$W_V5q(CiV^+CPKju$c+R`S~btE&c|?oquv)oF}y4)QOzh*2mK$N$`lP{8>9ed*n!(MAnJzT=msF4k?-i|{(t}AVoz)AX?6t-fbS~2@;JB72Z{5|`NJB4YPWD`mTq$S@F z{%hTr%GI-PhU`bPqZe&imaIX}?mV{ojA5q^;UlW8}D1 zJiZ2JFLwS8zz`i}U{B8^D!lGbmyq`wHczrV2b3}CsiEk^Abr5yR>bT^PuK4T9J4H( z(*Uw?;twL5n*8?*z>A2t-3=Ix`uPe z?i*_Et!^%g;)_L31b-~5rm+!yiirCop0XlO%ly%Y)dfHB6XGv_*st}$hXZIs`U9PU zhQ?&1A^2S-&ei7?wXS@%tFNnf>hRIA69N6We;CNr^a1vTMt;h0e?Z9ZSzN~Hi3TDa zm8{@VKRBU)YhLsUf>*370Iyh2_+7EC;Cox>tdIvy?Fo`IfyC-R@QKG7+|UtW&VyOO zk{pP8NQ#qSFOM`c9PaHZ2j=Y_YM6GY0&IVu`1c<~-V95)X+9!A>Scf5_W;7XL?l?I z5ilmfKuSimFw&3#A5>obQQ{1;sW{Fcjx*4ji*wG2IMm=PdC=of1J??1r~&b*Lk+AZ z={lW#hfss;dZ7jmlUO&@Ae7O1E1?F#oCRvDai~EYYJf))hZ<~vsyCQ(9@H}sA-uqC zGI|r)(BTCko7?~|`)uI_nup1Dkh3WqAPyrS)(#_B-GJ3nVgBoc254BMox5OlI(uDa zu%pP=I(Ss(<8Zn>zLn)xyM@37x^^K?qdLW!X#cK@!9heoG&=2aDVxVzA43?4ey0Nj z?4;r7DRMhF&3&U&=(QVeGiX;kU82;g`%J*_mq#>*d6t$zSmvO=ohD)W8hjGgMgva5SS{crD)?4%W&c0BsWi=#aQGTz63&hKPQqR- z;3R55a+`tmQ;^|1H0L{ZOPzoNZ^^C$w|)vTaEIo62X3ho1>&Ly$b;g&Q-k4v9vtUe zyyy;g>$gB~cWBTb@Rmvu2v!XN!q?uo6RxFHSOT_p5{i(`)x)Bf`wZQRghI9mb91R1 zmf+nd=2j#W1Bfs&m%8h$m>XlTmWjM(p&5mxa%hI(v21Q-!ZDC23+GZfIz#d0CDGYP zbPf_36}^!#BKk!{yvU5gn@2=s4-q*-xD%vhgsOZg+i(@SP0UWG~eLHN4>II>-%?SBX=JRk`%UrmZpr=sO?}L-L*Tj4b#`n{4S<(_o^#vynVD2 zPm_G#Xp%Q9rg>CGYdU&1nD1owh>b&_teH&$1oJ_xti8>@l1J4Tl} zE0xp)E=I(*Y1bAco@XUyioM&4;|v?Q{kw+HL@7B8Cwbqsyd#l=I&yZyQW>uxB6M|N z7rY=_J~~v?qo@{gi3W{|h6^xqdh2`<@RSrqh=TOHB7r`LFi4sk z67Z{+-2xWa-Z_PnpoA;H(W(c^je&^D=bpgY`J%;n6*w|xAdo1YmQ|vhe;eW_K(b;a zu8g7u;PUna1~q{kW#53)+K4Z~r`hR^tGyBYbxpzl zRJd}f4*!2TW2J{IDp0y>cG{_WNf2{X;Rd~Eb2q*8X{l6xd0Nbm?{9kOHAA{mUs`zx8zBs!l@5Z@tuH35~*It^Va&A&Dl|g-U zRl0sIJ>8W%m#OE6)6$?(xo(QhT4{Vv*7?fKB!8BBAP*J~S1m@mNs-T|^wTn(f4=34 zSD-fF3WGE5pxUEP@`Kj=HZvFGY4PbGnJiEYDG!DP`h0kMdvbSMNrGeX`JmqHk0kL1 zNEbtLBvI(c;C^&+-vKA5B>X{k4qi^l-17-p&b*u!QtZjBoW?&Srjj0C6jNtY_+#2A zR?h^co8}vX>bcOl%kYgm^rN4txB69Xe$$`8AJ22~rY~Q#K24wbzCdRmGRb6foSqL4 z#QEjzGIyN3Zsf-&$>ZZ=eqPMHGB>Z6w-3pAah^Qk4^HND;qEn^y$8cqGC8W{!Ckh< zadNEEQPcb~vVzNqKnQ<44D*ujz;MZ5@vBD&OgzPK#8sC=9dh zR)&%CES;UEUS@Z9ugSuU?_G`h(r`E#OLteN0+lJJ#oU=xxo`BJ#Jg0J7s=~1byJgH z`Nr*QiOe=f(%|}Za03hS#j}$N*{D59chyrtER@sKq9(nf}1x z1O16vn>*=hJ?zPA?lRN2g z{Pi7sa3^H$&X=#_?trgL$6W7)Cevs1>~wj1`qHnz7H+HHn0!5(U5gpEcUL{5FE7qo zcNq!XrP-U#*}?d!H>vmU&&IczgR64-p;ydFWSW+RWc~SkL@l{CH?N6Y`-PWtm75;J zG-ZjLRnF4K`NF~Luyx4%j7-Y4<|*AFPw%VO94Ft9Wm)RXD(C4-rUjZ0OyR6i?BCqURQe`G&kn%7*tqQ8 zG{{=2)PI(Q<8P?apO*!pBxXF|*Gpuws;Vb9)I@9m=avc1BJI^;D?%!nY z7B?yWnSU8%Z&E_)rY21X?c8kia?+`fVLPWM9ezZUoy`2Tcgh_hhpmWuMtv<6v23 z0i*#A_t=*(|!#KB;GaC4t}%D3xNIeAfi?#i#AcA4hu2kE=h1seOwCEHJx&abo5 zNxL%;>cyMWv;b1YhjFn!OkMJ?g*-pwne^~xcr%*PulKi|K}Mi1PXtny?lLnLWS%;5 zouRWg)ytw(>=neuu=AR|c~}a)69K&#`JGwP=ULu z&>xB13!h}9TY5yF+>a&du0PJtq~2{hEkGO+=A#+7JMZ&Dste)KI+Gi{64w?_Dvf?? zn7!u2#q4=8xgVdA7o)55W>0zhZ0d20G{Af6Ws8D{=;ae4svvYP^gf3`zq=R&4)A`j-T zqd`HwU%nKI;;_K6gXMV*++Qx>7COGaTYKNF-jD~WS@rCy_>g(H8_r)FS*cp2GEeNw zuyxmEsUf&a&P%VQagv!W#C$hbXX=!Y9k*|0B|dZB?Pdzn^&olL%T~!3YM5&`kDs2? zCkM&=^+}gJkOi^l)XH8C>G@6WYMDe%SP$$C37Iwi(K;IHA~m#)%@)f z{rZ%lpM;0jZ89srrh4VuB?Upl=IDH{e)(|M$Rx$$GneT#PfJ4Md30T>4J%K%MkhIV z<VNcwu;zYNj6g^?9vuHRuT!6?SyeNuP}}mF(=Y1DTe1x9Aj_ z_4^dtEwN=bS1wQ`@}4}uWXJV;I$aq*Pj0Jiq1Olb(E+F~YY!#1lcI(0NpWzSlb^?z z!^UZyWW>(0btzo++tYKV*_f1$=NEK}e=P&4clAt_YZoJ_v!vxpzcYQfT8_x$26rhn z+Qr_*qV>uM)7Qdl>8an9sQ!KTxy&}s`cGYMaea1Pm3xcc8CzwA{(Z96Zl-6~r?s)v z%vNfmK-R?@seU%=H>622J!ezLSDlCM6;`MyLwFHcG@qw3x4HJ^V-w$jrBKi9eH`ll?Rg_s80KvG@ACXr|9^b60$O z&Ucbzo6EJXq!+SzaZ4`wgTlC&tk$|GnO5-y^y_!cu29Pqp`>|Gug%(XaC3T_s}9;V z`TS+bGr~ow_5$~a?8S8|O%-2mmf5pOX3owppNgZ*xKJ%MMuXGy-qW-uRRQ}{Zrxl@ zd2TwmN}u<0gZ@}P0cUNx->p!Yd09M_sh8d)x2QGf9yPwbk>uPI+}%)}hlBQgwmW}d z9=fH}_42HihFhNebX*wDs;TZd1^0Ruvir*s+{>Tx-TP(ff?ga~UoXlGd&9Kqc_#B9 zrjtArbF$#N(_Kmef08MrI=Lnk{tBm!S*g^6vJ+2UjX_nIvd?#Q_Of1NhlShAo2TJ< zv7cj~W@PPF0_TJK;=J^dJ)7MOh0Ci&^ELHynd!`z^5l5N@Ga)}DxG>|mSm3M8cq7L z2$s#KP+*0H#1FRmPKE@?~7jvd5hkJ9)l;5XhI?>q42y z-Y+>u=#BC>LK~7>x_K~J)SAWXf^=1>UKC!>?vJ06qucZu$jHOvY^~35z0nyYhS{hg zRjJ(7_4tzIisj4+%djP(l^K*ydQ72ve0@8(yuCs2XTVkWY*D_SqP_Yi&om{v#|_$W zqq@1RPtI?b>F3+r*|-b3)5UG4!4}3fs{R6o#a#R9{u1t;w-QbYpTwc2f0h?zrB6nM;{wnIDMF^I|?fDpnWAr_T@F9M!HdPvnRn z+_gJ5b>{eCdVI|^2esFt*ya!NsouO?J*A5mm$y&tDt&o&R>@y1ui06l0vGGD+Z(1! zIl6U|k;m2Ls5hY?FPk+_#oEPfdy>2;R;$gY#yxZ0FXyiBZk|uBOUHNFd+E40D=ynJ ziiN6H`nWw8dMBV>c)l&phL_zD)fCf{nS|@{fyTZSMV)K^E z(H*)zS`^Y}WAP?CnpK}`EF&%WgI+oNI;9UzZ)yj*biYuz>{XJvv-U|QlRt&xaQkwe zTwc9i=G*D|j7fpq@oV$EpP4NR41fPz={Bg$tibUPX=+kTpA3(|MQYSLs9YQ$$ocZs zO}G3!Bm0;2<6E+NSzvMxwOp;&%}i(36`r~I`9&qQ zXlBN#E`80(gWiZ5-uElL=evjVg815>9p^?ANM4P|{N+sS-Sm6H-Mr1`j$ee*?d{9O zE!^b?)eK)BOwUiRFQ`c~TW!AH-POi}hB!F6pF!EXchk)BXU&&o=kjWF+&`0!=h@k) zJ?eFrtiU`y4KA-msAo+o=i})T@}c|DRgvm5DVeGBgH-Y6LMYt~>Lc>%;z4AaLblnw zn$6Ocr}oukATNg(rH4K*(+i1bmy6TUO_R&_A0}xY?t__Y$ig9vu8O5Te<6$p^VvhA zL{?r(p#CtaOVTV|$Q_(L7v&E9I_wB?`;^aB%0sC)fSW{5?f`~BdB2MfqHvul&82bv zwnEQJy{j|0OO{W$QZkon_3lr|>aueumY2`H1ymd7$CtHxFyNY_!T4#`=5LF%bWpiJ zd3deeEc=;@%;JG#X|Z;C^-v$4&9nF8tJ%CMLG`2mRJ^0eEAy;Yca1MaGA3z$r+qZX;-A4=v=LPzLQ$$>MhivM}f( zwlT^sSG;*jAIjZwbCP8ge?>M$D96Q!hsv>RBu5MYAt+JwfF|TAI z*jG_KpU-2qxYihuw7dJ%RP-)^7Ck}Yb`yT2;6AdF1L`2Gk-ZMP&>OR41Nl^N(Q&^;N0feC+k=l}OX5@F?Ss!1Xsje9!M*Up*%d2_zR2h}u|8Al~hL zNdn2G(xC~Y$0;W`Fs}}$Fk7nXiMYN*@?Q{roV9vMLC?aK+QW;S>eq;|T%R zZyvBwB0iL3&%CyLAJ7d*k)a+DymlTUoA68@PAy#cXs(yUc=Hm+I?;`NT zo5-)fiQv1-MraG6vAB}_TlqhdTK-A$IO#VzoY4?!e=C30>3=+P&Tyvu`rC_=Z!F>i zlh)p5l=OWOr=p=231un-DT+MB;A^my!ywTubyGm0Bg<*RQ*N_g(zp38LT^|>4kk18 z@R>I(6iX3wyILW2$XzP95dVQKZebv$5qU^B)%BD9RcXvX1D_Xgu}t)VWuh$$2?&7| zPP&GW;3+1lN9u+KfL1S-lEO<#uKDL9umPQTqe4p?KQSHe^`IUy!mMwacTV9a)4b8H5&O3{NtL z513YzwjV!!?8qGYe9f`TZwNf-6-w+80Vz;pEQu;5G_t_iK&TWN*tLLfZv6JQ;g5eD zni%k~H+<+bs*S}luXG_il@GfT{BS4&-wn+sWYORSv6&$wKz_qWV1i&I07(|Oz_4IA z35@))0L5>Tl3F2~`9QE^nF$jXbWM3OfJzaB9fF$p6~P8xrjT&_L)ffHH-tne;XFOW z`LL0uR_zj+#7n5>Fhio&w?U1}F@qp!no%wVAV>+);Q%EB1_t|p=UG5{Y)Y|$>0UZE z!5d5ZX*~^yz34IzC=>wOO}*wPR)Ic~3gm8&-$=T_MirE@0Pwj)W>a|xr6ha<;Z5nj z*KV5Hk8SBhtoE3mc*k}t9h-!WEpE^xj5z(rwF!q$N{Ma4u|R~M4`vhQl-o2%_;%p; zNz5@_P`uFu9d&X9p52x+bvEADS}8kz*CLyGibXJMjbBj&dyjAi6H$C#(8bd0*R?kp zIcY3Y{W>z0tC4AwPVmi&Hs%bQZ3{PB?k&1IJ(g_@C1cqpmTlagIK{{Q#PVJ&@2MqY zc`ugth|MPXY*yYgCE{#b+}mzv(bIoINqe#Dl89wX(-X^Gfo_e#n8}px;Syj z^@$UQEX6-=227kd6ekWDpI9MvD;*p5jV1jxq&Rix7gd+st^Auz9onoCW5@t<(lMgt z5`}GPjijR3La+4}t44b1*v#zI(8q=0moqcR2}WM!VmmYOwFIZ_+nL`tyJ$O!MQ@W* z^g)t|VncK+ZM}0mM0_&prUzCs&)(7X0ShN+Noz^r4TCI26kX(sG-Q8b*)Ept)RM7m7t402&n;vPZ7E^sjZ%d^LXuGIeT?NuTsoE`jjerL*u^r_ zr}x~x&B>4^0V_@s@+ub#skr195>g%CZ`OC~<*@zWW=^LZo=xWjy+t-qoCp-lo1txQ zaUziG6DI;$ihtaUmN*e8P6RSOvEu1gIyTlDO9s$`;!L1lR4H<|+;1ThXe&uTn@In8 zi^QMU>Kb|q#`;(*-3J3NHa5p%);k3^7^&d%LM|3izpjM|bI@2=`qhLbSCi5vJ>VM>UCik> z+Y(;3)Jt?Y%X6_jr9sdyvoHw>DLlU9p7)#BkSdc z{m_O?W8#gGRjr@K6S%cC4U=&SPb^)Awy(u0Jg!fi!ec4^adT1P6rMPR$N0pGrd#RQ zAa5+`tNX+WJin+S4Ji7o4~?z1W#+lQSR`nWLs zV)o%UX~(NvY#{zxa*?xv*x{|?_;w8NaRuy-0yv1HBovNT(zS=>SYv-a+yQO!P%x1g zAIh>Ij3)_NIIkzdz9c4M!j$2&>c)McLyM@^ZZuFj_u*#U$E(m*Ini4JAMTZ4#N(lR zLLPAP#0SG+sk3(Js@lJ9U;2^zb@#m5_M%h|j=d%xl(iX0qV|clya6$l6a>b=wcK`lWXBeGsdoO?Hdi1uu65)}ri; zZ^%~w9;nZLu?=1>cPLMAT@l!r%T<0}BQUMSJ~ErDfrXEO4Us)HqZ?FNC=UBw))%uumgD2)?) z%#a|t<-R&w2pRv0nkE~C&RWXEA~Ga)xD}AVsY94R-BV^s;Vq!hK{MGRr%~u46fIo= ziKI!1?1|n2q!UG{!KWHw(Xc6o6$x^{L;VzCoD3U%L+Vj=>M)4XM7~d`JNu8;G~y_W zkGhIR0IUzY!-bsra@_+Z{JLf6kihIBAacx12G|H@gzNUeTCYT#o!V#U`N7E$s4lTL zWL^NhzeSAcqPp8;7o;dDs}qW4D0a?J%mO$t2gT0%dDw&BcuixD83Zn20cX$39FSP1 zVAHR_A5;eb<_;?u{{oCcrT9=>q76uz=U6W_(tg&;Na>Pto55W{Yw}mDH&?jGsslo%>F=dWB_mMnWIOrHDe46j_VjKP1|x zr854GcO?859Pxw^MGUG5`3z81z0rLFiu;x8t5Us*t2y_KqS0gl>j?^B`k`$wD}XW` zKQjQDgkKqD2Jd4mP}VJ?5+jj52Pir0n*wB(%+Rc)!Syz*7Yf@OlB@`KDTq$Of)Ru2 zFIo^#I0XjJVvC#xag79K8$OS_1oDmV#ZF$M^{j$IPM=+V2^R^!(%TFPthEyts0eZz_-E-(`SX?!yE z>)aa5=;Oe%3DOF(O=+C$srMR?=z|1Y+NBG9YFi|Hoq|Kry<%2sYx2Nb8cQQ+6NsV+ zYRroU<06i}j+Kg4i&2#dW|gn0hejaF?i-l(-cZHROzdun-)}J6Z7UmIreZffpd4-z z^MO^_m=DB!;B)f(2+EGNSgLYVwt_$csG6l{b&K2lPcUG||8dfUsk2C-) zKi(pmXe%Dl?{#)lX{y0@!BM4zlsmwh84GHOXqvBCUcurGF=pbg1mkkvYF|W^j}swF z;#oOJM3|KTn;p!rl*-=-+|V3gM#gYNy*1BaI|uwxICTC>)35;%5;0QXoXQj|Wj0~d zs<&=)kJrt{y`Rkr7AyoUn0qWWE03tg``Eb5ixHsioDrD;!zuwoJIrLt3lbUC)vxkj zlq3-niB1)B7Qt{djwOeLsTplln#4inB0<4I1D(@DVPTv0GL1Rm2}OcPRPhoD1k8vt zTFBo*z5e5va!q{dsd&OL1rZc0}u4a%Zq zw!G7RW4oKv6C1#ceZ~f`O&h{vqQqrmqKq)rm?$0Fk6@M7_GUk7{BnkA@6_=(GEVyp z;{6TOEzjf5w`-#|9J1i9q*<)L-t5!Q*5${Me046D@2*PX#t9@gRG6RGycrQVu?-<8 z%lYgMCxg+<>;u}An<`L)(R^C(VwihhH`Q15JH%$?RqgjNE5{B}7l=f4N||)C*qZ%? zt=S_u%6BM$6R|(cR2q0Vk!C{ivcJ9N z?PgNO!`Y(2MIq&=))w=D#c#+4-YKYKsz58EInT^ABMl(PQCe?yG?yVP)T4U1WWQWv8gLIb;YKx*whu9x|An2bwz+kZ0d?lT|wTv zX$h)GUlVwFs{Sr18~9tQyFnOi2oB49BLKEJZ~jQ`KZc!MY^A2s@J zYk_iWTcy+sjY8%#o9VN`Kn_Q~>6y@*BhxS>_{k_HkoLO1-nm8WR52?gdYV|_n${-G z&@@7geZ2%~?RMkvC(>#cL{0#{j*~MP?7VNWc{8)Bhsd!pGwXGb32$COW;MzQw{i`2 z)wJbOH4-QZV*&^$aBh3uT=t)ht(net-gwbs-O}3PXUg1&O<=AQkF(6*Kg*mS{?Z}a zo41S_rGwzM(ZG6mK>ftj-X~K)V#D0#SL1yRa~nwdiJ(yh^W1MBi^t{jr%KW>Nbg}} z_RqoPV|mcE#ciqTA4KPib@f22>hViLpb5ZtP8(MFuqBf-#|G2*3|jWp|HmascVa|LhA6u3aMLTu|gUvq*3M_ zE2ObP8Y`rM2M{Zy=6QZfg>*Al#C-MJVPY<2Z81&;js+}RgK@x>V~O~*Ov`9DFM)^6 zOAV4L6;As8Y=ZZu4lGbr_+RbJf>;Q4p64ePf;SkEw)w+k;)A7eiFm8jT8stkc=L+& zk8tyj#Y=|iiHIbv0@P`7RGsgF2w>L^|zUD5!_T9G!ky3g3pUF1YBe9EH09!TVF5skajXu0Yt1$#Oj1` zo*z`5aCqyux;rAEWC3m&l@+$QF73{M6dCG~l%;VH{R5YFmtm}wi%JtE*fuXPuOxa+ zi~&izN$-wRw7s*wG5>7=iFHQ$Os*J8;6;8Y9bH4Q3y+Ot>l{SSu_Pvu2r5oV3W!N{ z+Y`j39+uOT@ih zz4HVrwYz_~n_P{yqb{yK)ZIh1h1~`}VyMz|DwbtY;wMm5;viA*LSpxjU`bKh6Q@v; zF!nTM$tC1|&viPDyV>1`&rkbkePmOp*9njbU=9LjPRDIOymbDUY zO+3S$0o8V!zf+z0YPp=otFES7kBS`NLNNMxI$k%c>ljdGM2aWQp#C!D7m(vsJCXq4 zH>Y9iT|0nFyT`pwqe0uL#$g&HrcAeKmj1D1MTpl7M?;xTHFmBwP*fax|7E4krZq@DjscKlR^+i9^Jv zp2-oobYF3;$gMNN>C2{mHzS-@xv6mrrM4bxiCI$9=r)ezj}Uq)0@QA;D9bv7$? zh+Qy&y-HwpmZg2O$|h1dr_E}$Njc0xYq$fYEwnlrBM5d_o+33V;JYr(nf5lVh^Zb8 zrhucxYtEzv?R*C>a58AfZJ;s0Jz@28HzB9bHAAww?>mLJkUZG z8SAFIvsyCS&a$I{qv>oG(-iPq)i4wY#&!WnBgBrgO5h#NY+YtFRL#(Yc_4w9;L5B5 zbsnh3Qcwzz0Bzl~Jf&TmFrjlu!o_T8gO5Ll-3CZ}#vKXJ=PqNQCS{a-CZ3W{-zfQbm>A3&qnQb5y@@ujYFS~<$rO>*1D8n10_n`q;Q8qwD!^Cs(prB$p>4OxB>WL=7hRMBT$+{J_K zErhe4sed-JSXaC>^HfjTbtc|O{dgm<9Sv;Wz#WMkxgg*e`^^&CEHs@?<5e!olhf2( zS~6fq+GJO9tElf_4%TId4bp)OY=+7m#bt$k>JBi_Rf44mwd<1VvGQ-#kGMri(ZF}A z92&nLm7%>*#SvCKgt4&M)B9*=rXCY`nD&qd;9-H zb9j%vqtuk%^$GiwH0)u28MiPa4)5-NH|yWKKffFF5Xi0^Hf_UPBFz$c(9x)p+EOR5 zDaj*zW?hFf=|i!Q<3V-{8RKK(u?D0^xPt^DZxjA)1o3wMQizd4!{MI`1J{vhOp1>rxAa9P zKlH?f&UoPwkkt4Qg_`&^iE9jb0ad`OgwShm*8$CU5su*>Ug#5WkhoxJibU7P>Wd`6 zI)Hvuf?6IW{_*Ul(u5#EVat!&{^Z*r((q-jG?Y9e&<&;QL#=bI>j@OuSfH%Oqq_3m zF>Gp69hss4pzYF?{rTxr!ZS)5cedgx2!LI_gy3|mfyuXe04}4K)u zFN0j6FR>c8w7c&ICU>gFU%dz7u&`JPB-uwOx(br`h&)b@i^U=cP6fqhT(|?N#TlnG zaNxdqSqj)aZdI4IfE0L{am5fzjmvAxtxiD;f>Wjts7n(H{0-GA7HTznc3jY!Ru=}F zj#2ajGC%HmiAAf&8%Kha@F%s<3D2?Qa6w;>epf)ZfFAR-|yPjcQ#E~_UXJ}5-jX9DlpxK^Nr2)w?C zfdyMOKk`M7|FUgPl&BBA#~pshbrPkvw%4wNN82_Vuxs4nd+oEjU=(4CMXpS2gz?y9 zm9;>7Z0Zo=wX}yL39pBNswly>++?O?ih__|s z35W@llI9##1jcoOtU}9(i*wiacI^f^ z#g-bKb+^D0rydIiGMYPSLni<&wAXx~c z3XWFqhJfM3PPJBW;Zu1+Ayp*%kXrYz0P7bPJ5-JmX4QkpsLB&`)q}Mdbk&2(u4=1a zLH&tnmE0u0>CshRQxOWdO=tUx)O<+oZ$LcJUE2S zi98`Fb6k(6}n-*UCxObb~|MuAAv8eetQh^ySA6{4NPRH~Q0>@u?jQKtK#6)I+xZom30MAF$Ow|2+`?{J}w@C$xzW zG(!^{FA-xBG6s@c5?TzZ!U)hR9sN5w{nMAd`tAt2LW z#5-kYF$RLN!-AO%bqVa#!U7LI6XB;R>DD!CaChG|w#6Mz*3*U|rVcR1NzsGUbD+k`dESSL;`KsKrmR8&mZ4u8hE71@+3i+4-CeAW zp(AwxdPi#4q!T0SbZMo+V`f(w!fJR>*-}Ob=&6w8te7rVj zKhZz1Ah2`A)95f<(S1IvW2F`EHY%u|Sqop)D?xUOfU+hN`T+ zyZ=wXcC=!?3X`9p8BkdYt17*TqO_i!Hk67KQ9+89&}nv+Dd}n<(jE;MhU@x77zR&r zv`ADnBmY!(Ff}v?b-Nt{H){D29efegdbO(k9=2?6kxMTg#)_?rV19DYwI+B4F%7N6 zE+}*CSw$~29UMA@z>nhS1IT8Gxv7VrY(GQN6D75<-N0xWDrQv8{DrcMjh#O#$qXz1 z3&}z%rI(KbbYcq>D^@#Ss3=k`S5`T&;%x#-ZIg=-OX?U2pt7ichy)gL6$lY3gwSSd z+2}t?I7T?$6_#~=JeIb#(9#tFS;!?gl7?CfwGQMO=$Hb$p(vVqa4VqRNQf0sp6vuF zt-%nYL>R8k6vD9ucV6(r~#oOgiO@Hb)xaF z6$j(M;!T)W^rcp7m$APQTb0esKHPe%twmaOe8Huj_y@2 z%|fpK)@|;w)T}(hAB8m$(oq)Q0P;m@A*d1>0ktD=73C7fXbTRj-zCt^aS0M`4WgKk z_-B9@?=N1K5FYLA)&Pg@B0yo_@Eh{Ks68Uji$m=ok!sc_(!7Jl>p9d79l__&Mj%%e zwmc+OHxuc1sYHqIvp->3VKhjGj0$vUL3e|ZQzki_P{_DGWJbw(I;lhzC;$2za1>92 zUb|lACsUpSoU|7V2P@ZCrF!$R*Q-}{fA0U2R5)-F@d@!)*CZlknc|vZGfmMGdP@r) zFXvF%96{%*c}Cd=yu<12PdM>63|eeQsS1~did)~Pg*l34-QU>vsf_Gzasa`4`s`yS zEYpar&AN!mcm!ctLsUIB3=xOgCO4?Nu6=I926fiR`f4Cu^)a)Cwi-}VRr`pltFED^ zzQ1JPL2!{yB8je*M#kxg+UTY=(M@Zi>uI1{(munQJ)&!!@2_!&o@+Esb6qX--8IbZ z8qU_zDnExt8J|&vo>1G3sxe**RqT}y@7f9%IxrLd1rN-pI_|o zqCk-^fwa1SK``rxA`!xsqHJ;Rxw!?8BMH5sMc>NaaTD8o{LO018i5c&Ywx#L1s>u| z27=pVhpv^BG&eLeLz3G!Tds;CCI^;B18#9aIFxUhU*LGP@FrGg!>XsjV=}NMW8S8*MP5Cu(ivJ0l18lBsy91^ zU>VFTp-bqS9fD$Y_wRnC26`kXnjIMdjIKL~>;#5ZdG)3zXJ|dh z95td-Cxz#DB((vHB| z9K!h=g7$GR=^bqi6bqLht~3?Q-i7OwO?65f-3Fwnp6(~efN1d|BQbM8B#4eIP8o{f zWsyK98q66fNS3^%2c`KgctNX2BL7ky8N{m25>M>%IKgnFnSGZvAJxqMmoJo(^r*Cznypu4(@lt%oJV9*r zFh}j2Me~u4u03RM4}CyTyv!1o*Kfpbz}8JJa*xw!{f~82+S?6$ zu48-ryaM6!`5PloXp+fwqSU1*ZFB?1^-)|)TaSCsJT>h4LYM21B_Xr&O1gv1A zfno2+7Bu4*+@U0N^${|Ep%qICn2eQmdy6|W-jGd%_`i9J@>s6$*N|-@C~Ld-WCRl; z0^OGpVA~C|;lAls8_h- z?t+MD9tf=W@BT_RG(4u`I~ugULdnGb)VvvAQJ``B(%z&vCdFRon&rillp_Yhk6rgU&W1P-Zxzr7DH#I1er2N z!ttq12KJlAwR^@H;|h*`9@m>G9KtE#(G$;ZU5@35X!0$>Zp|#1VpAPhfXShT3O<;2Bb$6cOB!7y%`O6lp_oRB90Qy8 zi0`Y6S)y|@o=C=p-(Lggycu0F9{%HxjI&!|llD8bV;<@Hc%pAm%vDQ&3`Fx>{%xon zF?P8=k#BkaKuSkASJ#>dW(%79H9{BzMO3_PG=-N({ws%EdY|I){wH{N4KCQhwLy-m z^@_*yz^M%}97AZv`Yc7cC*1Wwgu(JrMbCh&#xv$ZjaBe0(|Km5Q@=u8W&-GI*+Zy^ zIh)H9b2j4$HyKPGBo54l)*as3-#N@ZR3$?iL> z$;$!->h#|36+;QU$PcBXJ{Tm8xNt}qSZoRP*HQah(W7!e_`X-bi=qFfihtj~2W{E2 zVMd*fdb;s$Qj`b!0it3OPQdtLZ~w^nXPrJIc9TLS`Tq|RGJ!!p4skTfZgHVoQ<``#@qp`OH?No6vLR2uy|g&Q9O7WNw2 z_OGFu5kz|Dkdf^gkfQ@AS%CaOALZ_$hNvwy=OzI$h9yO5Pn@!h>3BXZE2mCpaI+9w zoXBiv>do}ft_r!7O8IW>I}sToTgkENqgJ=9m2hj~nZZ$~JKA)e%FI^_;WR#Vo!oj* zNYzbX(E9Iax8gYxi?+5_a;eevBKRSp9|&h@_mGf9RD>jc|J`Ya`u+DK0ynO0SjX_a+>U9SL0IJL|G!C+B}47q>c&} zfg?g|$iewQNTDS_&FTPlKnqxpK|!=Y=^NK0D15{L{9qq(?uaPSv_4|3X^0^1BNTbm z#|TKGek7r--8=-ZV*kf8plLX7*r+ZX5SrGeFPfRSe_GH13MK-W$&3iOof}G6_b){- zC8(9u2>^|eA0i{pUmX#32C*vZ7586kJ8vElwHIT3U^a<|#-XkTk7ypkQjTGRct)S1~!9PN;

*gN@^`8GO2DV^$q{~ zU}Yje4Q+5jn4Z9TcPWu0$BJz*0W_m%&fYl7i&8~LD5s`=|DA;Nhh-n;RmTT}FTek8 zM}%vRGGQo0PPklC7K-7A#FCeZ1;er!B`|~6n??807}|C~F+@Bp1KAG3N(UNURn`&T znWN%HAao?6)T$e*IkHNnv_5@D=G0+EDEq{j!QlEGa_&&Ifaq`v@tzRTCW3h`k7&jS zWT+iO$dICqxb_ei*8qqp2f@W!$UMVCTt*gwfMiR|5T>LkLVBZ3RH~|H^uEI~{Qmm@ zu}uS6;k{p51}B_IW9G10GR!&(+iM5 zgJXkio3pyuS~Ga&+CjAlMR0$HrcHeG$eU;c$UR9BGL}%;CPk3d za6Qgt82F>=i6^uH*veR?P_xWw{JQ#L&;y|ENOtS+F&fZmsI2yUx8sGa_n6n=nQOhzkj`+LAEc z*JJOYCGa%d);-2(EodDo6TNB(bHTrixTWHiMnCJ=mDC|>A-gL_t=+DaO{8*8cBPd) z$zcv!!<{Lh&{AcMAlT82=eV|`8A`XWo9Zdbw0Lcfwb=O%RRzF__&o0a-`2}WM9f$aYJE8_(WHW<9HWaZ(=l57jhlF;IXnmT8mWgcywWFkU~B{?L8 zYyr+Je5$(&JJuWb-ne@>R$;t>I2=Ge+o#JY2F?2+Rx$g;O{((QojoMAJX42j2HC&- znkGW^ddr9DluaZi$JZ^u+Z>I8 z=#4=VvF=zfh~qj)_+SHPCbnI9HscBH^I>|3=hW*`^0*??J|^d;7mODSj}6#qkoM{5 zmyTi_cS1ip`hS1&H}H7k+&`|GEM0!QboM9q9;cpGH{zPe{bM)~azDHCF$6BTFt}ix zF{!}waeK{nzWeuQH3nqtxiQbussrC_t_{+@(NH+OF728)b1N3NF%*|V*x zQ3SqDpHDv8lbJ21GvJ?WhzE0n01~h8`JIeBF~iudmmX%FQ4UR?4zpQ2%u*UcOs`|d z&B3rqiGi=(;5q@I2f3r{hy=F?>*pwOeKWB==Oul)3tnA)0jAIaRByb!rrR`nVTAat; z60I%;57cv;`c|=GwWD)^)mQN!b3bCJV8t(=66~-yEC?KpV4(qZx}<@dRKloXv1uDV zuw|Ank>L7qLDf+DMJ0yJelfmwGuBvXn!M9wnKhrrW0^Cz2}NM19<2j2sh zG{Of!S-nVN@Ciyyr&vZ5`wTmNGE^AbocjGwn9NnSzU`{wZfIV|wnfx$@F>!HQS?r1 zynWPZWJ$vMH^Sy2N5rV|=>Ccw^;Qz;cQ6H`1=t(^)NDM-lDGhLC@r3#8w(0XIxGzJ zizMY)WD{C&eR=($KUE%Hx10_6(5jSw6T(;{y~GYbpamtF2MJb6H6%g{So(T@%zv*J z8D+S`&-WK8>ir*3=(vLPC{8dRQW!B)7%#D)Y;rN3QQ(jcK3_Jp_P8+&w*O_rWv%Z- zpCgOK48oY6HQq1r7TL1oc$tw{UW|VAD`Iw^C#x;MP_-FPak8}IqHqA~eHfB#g<>(@ z*htMx7d}|??v8)qZ2c2st2Z;M6b}FW<0pJoEU=9aed?xj+ur>$oY{>?Rv5LQxx&5y z#_2Y}c>Uw?w0!c1t2Zq(6YGVkkJCnO3|_?=93{-i7Zpyc+j-Q&rkZ3f8S*w2+ z_CcZ%@>2cqm_bAG`T`4S1;c42uY;$|+7ru%pseZ>W{@seolL2`Zm1H4b_TE&#j3&- z2{RT43}HGyA)fPd1_t_~Z$p+2LxOiY)plnG1)wf72q+7%R=B#W4`+6G%I%m-ST3*6 zTPqA?$${iUT8JVzMSasJ)1q_)^7m7kGA9fm4-VW9qiHfLKz;cM9vy0^DLf0iaZmLM z3E%&jpHcc7y#NE($KwSB;69XH zc+FF5i{$Nib2#Fsm?g3Z$5D8xiUNt{B+fbv=hkp5a`B z%t*5;WSQk6O`ptD117bCTgYUn^;V?3<%~)uu{h0%)h4$D6DUTQtEcSM??lV!94jiZ)UuVaAGK`B|64MB9MkSb?JKKqQ-vG>khf z;}DC7Tue=qpnR%t1V6Q)%I&d;B|f=OL8WYc+?Q~AD!O78ri;Dta}sMRW-4+LB_Tcd zi6%eNR*@J9Kf%0~9D8C>^UAapg)+jOP*Zf3LvH2l_Tr!u;Ms%~`MYHZz6MVn? z5g1+I{Scw=JKRHrremjlv|V-uaH9KdGAQlcW#sOh^Fk|tXFM;dw)DlComnUvAjAh-E`R0)0j_{nq4u#oC? zjo1mSFFC0oP%7I>VeAd0gip@3+Wu$dT;UIYpvGIuxgx}^H|0mM6tjfbPBJ`jdl(ad zA(4@bm@Oq?2zJ@BlD!#iP2nxF5lAkiP$c}2BZ+$wgmHL)zhvG3#%8@qlAJfxoSdv9 z0++UjUO&*>z>0vz067spQGxoDJ$*_Ncgr)H6_KYJJk^pl0oF92(p1~f6oD0FL!+Pt zdTM%0?XXC1{AJ(_IW)r^tZNGk+`>G8fnY{I z;|tR}A=%%k9m3Ixp9~}%Z-+Sk@-x8={r(FixOrZC+?>56m;@KKlI=^2dn2AoZsqz2 zJJ(Oa3W8pM`MH?FMh`i9uT;Xk!Wvi+h@x-9h+9ed>g#;*@AnoMN-@i9UDV*9gdiLFXMVTvubNl>2N${X~XX0w_PA^<@*nGmL*roztWW6QxU zqwmzAg@z^;2AyXt%#N2={dQ@nQP*f>UdlF@Vt;|W%{8q9#A^S}uarpnl>JPlwC9Q? z6h~8YGCm@rb^Ov^q|b1a)%NeJo_`3zZ>*ND#{`HK@+28Re9p5y6i=pz6H|K(B|Iq= zJPLths^9PLz>85|=VP3B?`0-1^W}-G1aDQD$Q~c58$Y$hU>yzrjg1OhVM|ypGBTKo z$e`eUxoHF3Pb56f-lOU8PZmKFMLxLO1Q9Qw*zPBi`G&zGnY%PTA%bc6N7PnUZN~_@ z<=hbEe4A1BP1s~mcK0W%4E}5swrX!p4tY?*{JbN+kzm0aU(J4o{E2kFVK%JC;OCql zh3GqZjz+=Z)p z?KfhNNC-|P#Bf~ZvCUZuamiXjRugLXvg}2nZQ5or^zcR_pe9z7c1WN)Eu?zvi` zI_w-csI-ZG6nsLAMo)-QyUj)#z9B|UH46Qz8!At;vZ~5`8FDP{OUx4LgzuBRP2@^1 zzt*H^%+Gk0WxUD~L%vZqhNMwmVA_HvRjFRps})?(O2_@Q1vO!GcEoEGnAaW&a$;(? zEy=3hY)~|HRU>b-HWQw88WK4F6+msITDHSW9@_;JYxsH_e#w#^r%qKe-MG*y_JD{o>%fLtF z5FIT^15(!Ra$GNseWCh1tW8Z>;6l%nQWe=8S=YhV%qKvcNFcCW8$JveU;&my@{H70 z`|P(Rt8vRha~vo0`pjzcaGVHM`768RV?H7kzD(bhd?|>42h0S(^uAG?N$>DwSE|-5 zJ1mCw1@M(xb&Zmj4AMR%E#yV1w{pKnimbn|$6Y3g$tTNDLY3kPMnmo0)%aEUwW61it;vAz<1WfGqO2M+Oawmy?L775MpOA+Qvt|HeR=i0QvM1YBCl zx8$JlHbP&N)k!AOWr(hEvV!Gtk1U}>GpW~Yh9RjkA6=E4pv?bvL&c5EpWs;;W@(Oq zuPBn-et!$FSfX*}6C7w5OHTd-hdB%Y$A5o+CKq-In$H%K_DPn~>di+R_Y!tjL07@X$(Z8IgkAGMH~yzrz3^wKU`g z$XF@2c{flFi+qzR<*^EfTXfv^VhHQ+-$75=P+7jt?d~)MR+Tk*pdZ}vecEk%_B@ze zg7dYl`IfGoEAz?Z(1)2>Piu1pq$7t8ELhvIyqP<+X7nAb(rB;&_ZPcg4%~m%xqWJf zRshNgFouBk!U3QMWK1YKka$s%w+W7ik38}~3Jtu{Q-GTTDioMNH6>6Cw2`AB z4+XZQC|VgYa)(I=3*f<&5mY1~L3=w@_K zds#_*8C?VQAy~r32@n#rrGB(&Oc3<8>!`XKM==^n{11utrRjnwnw8KG{2+xf@ok+~ zaC&;`4sMpABz{KOT7qZathv;EUntO!2a{TnUvMK5M}a#AhN@~*pBLpBWd+IkR|BTZ z98hkBR2cXI18H|)AfP}fgY&B=ux}s0z8n7N++{=eMnSJ6xGBF7(9()HBYG}{2Ui#K}5nv#I%E0P@L(tVJa^5LW6jq!O_bG-0 zD4|oD4F4aUkX;&oWwQJMWyKDmH_AB<3=YG)Y{_I58N8h3hY!a9ZK*J@4d5&`ZWjX3 zPras8OtDLmm*+VRE~C#=fU%460<20=1-NM$?c4koEn6OVQF0$L2-rpg7ndWUQz+8_ zow~{o0VW(!w*Z(^25wx^0Hv8|3ULBXi>g=HBQ00P$t)1thdd6Q!MW8}Srh0FP{O?< zJfk|GzLz11K}KQ!Zf5vtKX!xfOxnX1~^4} zpiJ1b`9m6glb#myK*2FIc%|4$Wa$3=ZJlFuCsDiQ z#HEMA*vrNm;hO}H1xAa;lXD@MuLXvz{oOaXJ<{IqwJO`>7uL!HnR3b_Gt!@ z&aJ`j#3B$B9nwPs+Kijq)!z9u;U{z{NqsdZ-QpTolA>n|9 z+#WrzQZ9HP8r^Kf0Ua;`{o(!V&FMAb*ARJ--Z0*vbJ8G8e{%6<h@2l_B;sbW;~hf1F6!AbOTa3@*GOb-_+`!7B3e0{(NjMwcK zT{8hF`Y(+#8wEt!7K4I9B6OTRH!}?0!$0%HN%TF>bkSQRN;Ea2n6cJ)wsdvha05RJD(^8=yhf*`I6#gEW zK}mi_xpl!$%50BF!Mq9<-)c&6lHlUJq5o=N2{7P5CV$ z>}~@U2j9jVVhE0R+f1OD0Iqds+jtG7oBH`g@4tZc4(26Yq2T6$B(g}=Z#Mhx0lR^y z!SyeP(eCk9{6QEsXox&6BKG8b$0M>mO@HCVW=_ZssKM9Q%)RX8bilX-A~r7r#1iXt z49bam7X*wyZ9uFqCU1h0Y89!`ySE)DIu!P>gc(*v6V9N`spcBhO;h+zoI7qi55K5r zUum^Gv50Tq%wc#t!Jid^CDk1EvloH+*S~)Qcqk%aiCLOw9p}#y%fxLzTjc#^S&?%% z|Im4IRi(m^CZ$^r8u8V)wDy}NmG_{}WF%H#&c&`notHzgW>B+={tMsb$UBb(ndVRI z*aOfTI67Ys{;rBQSlWaug_p#QwsMOV+&Rs7jhB*^F2qK>aW@YJCSmCVtgCm5ojo8V zz)1AYl=1XOXTzWz%@%lnBPG$%Xly$x*|9dHna#YFz?TuV@;8<|p3$*0XJ6z?6EV^( zF=Mg7vlEJ-G`~}!W3*IH`^Ra>(b*dhZu%=9KS~o(VA1cG_acV{=5wp%hwQq^KN3J4 z3-)^@1rHYV2c}xlJ0SaqHZ-9IPG|-4M)in(XE89v z+p=I_S@ogzBYHx_`}nA1F6N=U^-|t*fOxGKcvcIGdHb)yW^%NmmZt)L&g2iz23>aI zi$KWF^AMb)dc&hH%otH7`u;!k`F})=5RA!pX`1&f!V|9(1u1gF_>++gH zOAM(+&VYT8t$*1bIBy+_aC7#ir6!~2&X*I~@yhiUWa#;~1VH~QOid-^KNEtoH@J3r z*zM`j_HP$1TUIX0R5S9rkI+RwuDy0^Ag-~AavV?P+VC6HF`vnRK~J%Q^Blf(ze|YC zmb2f(U_dgrq5B7;)}G_VcI*q|SH*I;?zOvajgBHwy9@Q>CzYF6naBjDAf3HBZIy>h zD5qV+;|p=nIzd&h6>26D z)zE`)mAU68o?`{G?!=c`U#xlB2*%w0)ZP?&qq&)t#5nIV*S6QY%Utty!GC`e{TMMS zY;HbO9}BEW5Z2oPs)pp))RiIW*zhLDQz6lmTg^UY==`{gb$^066;v)FD} zFm8@fVL&L8f_AF1`d&pj8>0p+IEpMLEB%`g5(_>4$nY~7o@pkK2r++?E?&F3z&9vU z`-D|q%BSj44?5BGVyo|0upZXzvv>2_QrEMb>?A3dsR3I)jO1dRRu-mTlVHv1Z^j3MculD zl|$mgX$4c0G1R0w6UXc^`87o|5)V--GRE|n#9V|i8!l${eURYwEgW!kL)|FM5lt21h@4nK*z!hh?FUpK+VJFs;z_HAqniQ`ontRZV0ly z87N9SBG3~&i3O(QHR}7_JHpc=!w1R}JDi&RXql`xl<+c662%PLoi3{&kL+|+(i73A zNpDomHYar1mH;HW^{69h3s1K6ihW{A=e)KJBnM>4A3WFVg7#72Vo&d;c9I&m>cAD5 zwu=rfl9z;$=rGa|eL(b{kfrDiBGop6EY(M|bnINhSzC3u=ia-HPrn|^Ah3{aiRHA7y)bP!&C!yvXQuS3qfMPihjb6yOdgwj-1S@da|%M8h@=XB4FBOXy#GPFO~G zoUyMbm5=}^TNs-^J72|DV6nc>(srhBJeK8jjYw#7H+p3lIiPZUVn{|l=N_gy6lOfe zFs^>9NcHP4!h!uOgobg2pT}`dq-^`-Ft(u;*ZV0u8b4)TZP~OjAyn`wUvinbngs2BF;RK|1Hqg}30%U|{o7!t*PAr^fA?A>lKSQzXm3W%i*; z=!F+p(d3a(6_5}WS^L{{g8LB~i8lH<{3%BfdBj`(IBw)O%}#l|5d7X9$$Tk!y-vrv z47;J)7=`D>OF%nx{-`!_Nm4~w%yI|))-1rg*+GVUk(a4rVvxj!Tz<6GPT@{8Khcc7nLIFJKfvZ^%Qf7K!#Mso zY4yZ{<3R)jtV8%?)CG9u*kOo1M6D5EZ|0K)4sd=7vt=<}n?yFX4oB(LeA2Hqe<1ZL5$;{9c$__|YHBW13g9*Y7_h_mY!*lk&8sso%ham_jJR2%rkPL1csaCrTLCP=V^7-K-*&EU%{ZvJS^!U&V53 zI^95|R*8MIAK4CEZB{0s^P&h|Xl`LcxWEQOq8?XG`-wJ(61(0NTt7+9%u3Ft^b1vQ zn5#ob85EqU1{7!b+U5yi+;I_=3s(5b+JeQZ;|l(H~g_nlfiE8Dqmi! zV37WY(mL()8b*U}?L7i4l(2AiS_}8b!;~Gn;H z1Xe|SlQHm725}du;h9s**m_aRpcxJ&f9%1R+Vz%NGGk>0B`)>gB(PS@-&8z#Wg~BW z5^EAS8&ZK|sLjpv?X6MGRr;_qP}&#tFt;pk!@urVGLmo6$sNb1ZTy7UM3J#1_pQ9M zVP01<*dQ@+MCok7vBco+A|$55u_fZMSpFAa&T)AuNgzZbP6aPbApQ~4>Uf!6Mtp;+pQapx+*Rqq1{2g3%cv2I*ul1AY3%U+VFNvdGMj?N!&DCPl6vOc7g2a-G z;iN|^0@1|laNe01_y30Juc-qJw*3b56$x40JU=9_P-8m!xp`U>DK-C90#wMr)F*_$ zM0Kg!pX;e#PUKj%5dKw_AV31d`ezU(=s7^YthOviXf2nWw_o{xtL)S;&r4ujk;2_? zlPI>(zoo5@xsy2WM)Wl4XUD`aDdWPazr$qPi>cT}$snp2 zqwY(1q8Rd9Gnn(OWJG_`4~s#p5hKvp(gE5Zav-pKKP@2^m1i|b3zzS1#D%Q z{18jIJSqQqR=QrP;_U7D8o@H^*JKJ77aE+sOU-tYEZh9l*6IjVLC5X}O!WRWr{71~ z-`Du9hOtCf2XphpPyy+79+eu)YeP)n{4bQ^Vbph`C>zG~9AjoWwgqdvAX!ykok4!; zsRl&8Tj4@|H2o!6*;9OUw7bb_hq~;@5e3eknp29Fy&+=W!kHV0^phY=NxA5B)K#B9A-w3CID`JB-!oblwtSM$_F zTh0MR=-LDhB#qAQh7FF}xhHLV4OTn0Lh+FBFSzI9BU~ius{`9YK&cg{1QYaERZHB7 z_~Sbtg?u1;FE1G6VB}G~nF>?h-Cm-_^?_PuRnoFzSkz&qY1I*iW=$h|lj;_`0cKZ^`&upI|`Vqq#_QTJj zb=VoGQh~H!Q-};9;acc-3zivg_wZ2Op8)lDyq$Dj`9H~CCov0Mn?P{zSe~rizS+FV z-=}y5{nJhln5~R`bto0hrcLH_XR*T#DYrkiw{$D%S&5AlksB-P`oI6vSv{kskYfJt zE`fs8_)Sc@pb_$lmI|!*>$=W6mW@qo)%G{c?E_g^#SO*6;cWKW9IxOi4;IA~&nZ{>q<227>Z-p;CK|Mmkhes0!GKIy9A-?Z*bHhjHFEdb@LORasLJhIQ`)L z8H3J9RsJri7nBXV@eMjjy?I$g)|caP08a079a)V5G)aa+o1_%D_Yt|(y8$bl{HkY8 zc{osM7jb7{9Tg^0>EwBepV~wEk--aa00ev&!(AQuTsg>4ObUQi=jOHINnM*yDhnwR ziXY7%3#z_NX==Dlr|wIHf&MA*GrRkS_Y*SkOLFHSu9anI#)vf$5c#@)9i{UK6@Z|m z?2$7zXPk^$ZJzSWx-lj<+&Ct#igJxL&6yA!{6xpT*~2;pI2mh|v#RMSAAzw}V4ALyurvLlQx@OVRUbLOdTqXAZaMg$$3rc;p>G z!{hu1o)i-^CacYereGjcgP!vnO7;o@#8OLN6_o)h%il!{GKok6^^^?V)Br-;VX&g2 zY(~sVoB-C1tj3}mi&NRY{2EC6ENiBamrr35Ids=hf)tai)hYY#A6)_n2^X_t8HWnc zifgpxBYm)hHM~|>z*a33K1-jGyN8fNBuW_?n*+X$C7v|B)}6I-78y)Ld#k1jh~ftP zSm?)X^F~pRbkboIx>@LUNG8d1xXj6>bUMMe{c{C&=_#GSC9ka4VYF>$)-}8l++=D^Nc=Sx@VZ6bAE)q(_nv|GR9fr+fHt4)o)>Le^CnR{UAza$T~s zz&ykffw?u&x@~n{zLd)+ODYD>y6tBCR}+W3p@}X!6cb11NJ2~B0T(;~74!1y((Kw& zk^L-+c169(g@tVouu+g7BkV0dq1|D4=T*4XsX;}P`gP-6G=jFAui03>tkIckyfD66 zJ}RZfbMdRvxRXa8`LR~H{0Vb#`OD#+!GZmHV~M8Fqt$a&VTcwU?egnUyIb=46)6l& zTKXiv_GQean2WRPC_G?nv7z>)es~z1L*^RidbZN|xy!MvJ0mhCD^a+#SW7v3`qZp> zNQUz=#LPl*J~%&lbacP}=0wlcO++Oo^}Js|nx`$%d=fj8-SX%uEz`1=jm#y@QTi%o z;g0^EEl(pql8II`lNHx|e{@o>bYdF0wo5z8pq62F_p=f_3|e&rlp)`YsMu6RL^#p zyE!3UJNroEZu64waN*cKq8qytX56#8cquJ^JgdoNw!*1J|M*Kgl@~9ZG}tlSBGY0s zul8hW4CC;O#KXhee!c>irRY+?=FK+6gNKVYinMe5?(n9-_5OovIiXB*GExV^O>aff z++*)Np}l;o2@(jN{MpVF}^zKeS^wp$?7Msxj}R4P?XiB(4g%t zcA5w6ijq;9*X%M=TE|8mzG7foibGw(`WDlp|1koszH?BpdOABMCD@radFptvH_^Uj znTxs1^4PH2%PxO{WbNSfHHez$VHyo$-9|;7As&PK=Gn^Hrim5%Z{bfCvwEBv4$n<$ zNdA56Z4V@^<*vDm8EaXmf}N*I8<(L@G%4s+3lY%4EPbcKS)OhWF7G&xO5w~Z_~K$($FAinyciGYZTHNH-qS0o zssRcI#cOQVY*NNgXZgym$z zZntyMbI{*?Vxozd!F-KNVh1Cbl-os99%bml;d8%RdHN~n{Jq21oJ=cupRxW6WQTh>ZP;NKi~b?RI0UEQ6Jxt$fq-x zUH!UQuVl=h%hVTiXbLPJh0IafD;&M@quObU_rmOx%(9@8!{yj;H+i+2z@;fzAo58x z{xRlf{bQe!7B|PDI+Cl%jv7B!H&EB2x+0x`wC%m!ycMk7?p(wA8uVD)>|LCFIn?*&ZE0_@#@>8PvsYX9ci_W$|O}0N>`~7Bh z>8)&aYNF8SRXT;%9AQ`W)YD-*d9^dahBswx{LzOtE&c1i86GG~BSi3GO zqYZfEKhI+uXTDksspo2c_EczdrEwC;y!~s$q&MCg;@0Hq!CR)SC28u#=F`R1Y9sX` z@Z6wCN24av*3Rx`>RecFc?zcKvw50mr^Q{GMIrTQJ#(_fJ%xvs{9K(+UW}6Par?K~ zmgSg`=aZnxPmJzvfVVQo7u;P^-N2uSJ;*=JO?R`s_pc{>4H| zeEH=EtVc3$@%pq?mD61LxG%kO73PQHrbmK~IehYCm^z;Gy9*jA>*11IwW6|gFg&Y2 zOMFoM->=p==4f~~XGcd~gz5VsyYChz%gk-$X;OpS>d2{(hgGOzS}5iO_*wq;ncRf5-mp$ z4qi8IUMwEXMwru^r-vr(xWM$Y%-C)kyT_@Uj|!)Oq~d!6XS*&_%>4cOFS*OSRren4l3>*+2yN0x) zXvKr&BJ?iY2W;e=tvm=%ZCX!oH&yfXW=*-$E%i@~D$_CS1|2)mcfqC&*33s|P4n)V zbF`9IM@A$v?jePzVRke+jt9H5O0zBAM&_$$HTUZJH0Og`QUO2tA~DPPgD)ptoXOV* zA@?LYr;RNtZQd*Co5uC4oVGyA+_^KG>5=BkDxzv{XTqtHG!WIVB-3MeFK<_Bm`#q_ zQyq8n%T(PiTIClgc!~Eow8c`PT$(%ISN&&P9S1|P1Y z7dXz@7W>i83FBE3)q8IAjOh#2ht8>-r8Aqm7GEVE4X#xQhh|1~BRZ%Q;B5?((T~T+ z4yWP9RmSkgo!VE*NeW{d)N>b*5W7uvgVIr!-#l)-Dif zbGk;4N;as4+LtsxUhJ_0p`Vn4&WqcO_RiEzI8010kzW|KnkaAK1hZ zyJc2fCG3a#EczCi7r3lr#t_vZ%^N$r^y_KJ);5@h%i6piA0^v{=+1FI)W-=T*M6PX zGT|Nq3LRS>B`yH!&bgGO`;b9#8V}mdjwJPvWVF6k_Ye8@iNmQUn$zTY%OJ{!G{-`Y z+4h*e%ln`w$b=HLce!?Ram}yS;6xZXbH{1X#%1;WtrKR7v4_G9L+z=@`K=vO?Gqfd zmeC+PCztZSpG)Uv=Z$n7X^qhmQDHpQ*NKny5D^1U&dn}f9%^K~3+LZBXH7av!C~AW zCzCW4oZGd_9=MJ$(m&zgU56h>K5OB}c+R^@cfQ~Xj~sN2wYK8x@&P|x<1Oz<_A|l1 z%5KxxU({a;2BIHL_V^)T3?jZ5v9$$VETjfNz@!)z8)&-WlJlp`g?& zy#Q-%vAeS!wYPOjz`&qw zF0u`E02xsz(TUzcA;gOvE)XWwFnwd`ZR@!qgNK&F|3;@^I7d1dzt1#{5;6SBPqIFZ zEC9zGm(%VFA8CW0a7_JN$Bp2Y9<&#SG7zQ#V^S~ArXhL@mDr^g^DA~~UA$#!2{W+? zQJ3xr6wVgyM%OnBP`SCy#h@sLslGz}kFMV>LcjlZf8uYvFOS+HY5AL>(zPry9S!I0 zQH*s)bQ+k;+W|^;$DWp(unt9X z`KAd3!P6(_3Dkl|Qnf=nr*z3gFV1%HW=oAsE1M3~lnG#->J*`~^zKkX^%ZaVLk0EA z>sy+`{-nph5r+hPs0U{dyncoT@QazHjg-Up zMAl5fI6tPmzx|K4Zj>jJs72XzF&wQz0ux4S-W2eVcD~SqijMBoaC7T8WaW* zLuz{wS?;EUD||6;3MWqw7R&C{!eqV>k0 zc^uIqws(}s6d>37|65)cw}?+Y#7gMw0aO@!T0L0Oh71PUv$=y*CT&0a{}I>agWv&( zya@kU`S0%v{_7Zkh%h4WsRKrVmdvTbCL3EH@ssBh56?@SHM-Dj=;g4XGtxao$mt8( zPznT#h3%lWZSE^u!|M&w^7*u_W;&#ke`k;-=T;_y@hW#ay2_4BCsm1N<-?apKLs~2c<1}=_1$*Ff^BF1k=Y%2?7z*cb zh-3B2UxXRUObroj!CC`kWaa-={mR@t)9UKlHc~NZ<&yvrk^NmFAAxkF^G`K^lKWST z&c?oTftZg)_Xq9hoJ<*d$gfdjWVW+S3jqWs`skL!cK;*-|H0>1xz16& z11()}wS$TwzGqVYYGm6?rAZHefbIqMRTmeAd8ezPoWr3COk{`L!jtm_w>go=Ri8z- z_)!k5U<{{O^Cbcma2N=QX1Yx7pUqZ6cq`E&h?H#E!=$8?_+IB0a;*RZNUp^mD^s)1 zJ_J^Zn?>j;=wfpJeAYp=MMzT3Qo(KBxd2uI1z{BbXKl6+S-gS(FN;!v?b)2uvnWPS z2m_%ii%FY@jByYY!foq6eTK{)N}YfM%-;(M3F!q3EL>zc(dgL&387mqJq9}XKp@6d z0zGX=CP{$Xe{F=6rAr4qXvL?ysPT@hS~QBMCkScl1(+}>xoIn&AY4ZVL4zSYp~cV8 zlK`%yG!3v-JdZLe$Kq3WGj|d~mV!(Fev2m17(=Y}zF2b!9-Dv*2BHz!o^f5=t33JQ zBZ0pEo@e<7O0NzIligJ97$s71=yS*b=K%bDskzxe?XG&6gjpl(WY!>pSx9Tza6I17 zt`0R}tL1e`n+QnY@pt_bKqNX06HJdF0ZfR~Q~cYs8qUR)PpvQm|Hoa-2!I^@Q}}hx zd885%>J5$Gekp5a@vIKi((N7e9Eru`oeK*%w$bU{tBEf-cjl{cR%jJ(*P(duwLe^L zaDlOvf$*QtO7ct<=rmE_^>m@$5kFCfSY~aqMeUIIc+tnS zA#*lM-F3r{11h+7cQa?7Wp@~|e;!ed~sh=P841P+e|B*TBx;*fu z)|lOgFujp*Qy-ZnvNDk|ukQ+r4ZZ-73&ClkgyJm;_C9hEt%q)%z!aFrjO+&;kJvJ) zof%SXPO?S21BWzF;_V<6RQgO7QVE*2sd;zV{d&vFcSIQ(X4=BzxM{JgjijpC#6r@q z&s88s=)}H}wQ(~1*n;-KmSyjp^ym|q4#NoVIJ)5j(EI|4!Xd3X4H5%MXK5ft z31;-46JvS_Ha=19i9180KnzXr z0t&uu?%2(*k4?Sm`3;nXIZG!rsbkDlhs|AQSjV>?6NXuVVuUO&;Daq{L24sQgMzmv zM7S*{|4=}@eo-0=XifgMdEtvT^m??3nE$fPsDxJH5O2$?4Gul!PoxIuy6hY_3UgB; zeuj&NlWUb>hnPS8Q=8=98hsfE6MCr`%YdPHkfadrhP-_;4?Rk&kKi&CM%@LPdW3dI zwUCPd!4~~gH2v!nxQF^4A|lbi3iG1QQKQ~iT}1qR_EHP9WT()(sEAa%aA#T^pjENj@W|SFdVg=n*IgoUu;Hg3i$DEBNaV^tnsa zZqVywlmaTxs$yGM`;>N`+lK^XrTh8a=>)-)MsnR}l_{1gTIPP5(>3o%*ikUFP@zAT zK0((Xd(Qzq$v^-_A-b2`j4!%cuj3O;7t?T-VD>N5dz(YvZwT>xD%fw(>O`CGqRQ?P z)HVyUb8+UzML(+WJD59?2o?UQcm!b$h{jU{nEa1pcqo{!@2}}^aE5Ayv^i_O&-7do z-IH(aq+CX7h+bom8atk<%AF-AJzU8aUit6ZuG|@w@1oRiSLHQ+j;lbm9!hVgu!$7* z6u!p=&Hot5s74w8&M<*4k-WjbMKF8^GV*zF7_LBy)sbheV66ZM$DmV4%V)T4lc2!Q z7Zcqc%}ncaz@f|+mHm{nrMW@#&1tT&R2$*vXZqZ*VyE1t_|28j1P=_wLvl$YjLkSD zt8{eEF*Y#sa}t6`rEo2 zr?2{-(|>K)SjT@J-MmkFy?EdIy-(WIZF6~dzcN2dU^ga9Hf*iQxfi@c!NmR1_Tek( zfoNCDUMFr$cc(1vJZRRV#o@g0nUun=>J00FG`%L_%4>S1>XDafF3e|&Sl}!$N{h4X zVs8CXSI^zt8{(5??lfAf?Lo14Uw4@K`5#bS#lFvxdApHNr`i4sZLTVap|FE*RK!@l z_N34hm^;{5 z|G!1}5m1zY3W0#$DItIm{-?svSm4+BQ`$<;%v#aN%GUCy)c;-%4)LG2Kz`1^pYfvR HKX?BN#X+oG literal 0 HcmV?d00001 diff --git a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json index 8c24f7b0982..f3f1566d2ec 100644 --- a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json +++ b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json @@ -31,7 +31,7 @@ }, "variables": { "_solutionName": "Cisco Firepower EStreamer", - "_solutionVersion": "3.0.4", + "_solutionVersion": "3.0.5", "solutionId": "cisco.cisco-firepower-estreamer", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CiscoFirepowerEStreamer", @@ -53,25 +53,25 @@ "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.1", + "analyticRuleVersion1": "1.0.2", "_analyticRulecontentId1": "bab70c8d-220e-46dc-aef2-1411eb43284e", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bab70c8d-220e-46dc-aef2-1411eb43284e')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bab70c8d-220e-46dc-aef2-1411eb43284e')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bab70c8d-220e-46dc-aef2-1411eb43284e','-', '1.0.1')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bab70c8d-220e-46dc-aef2-1411eb43284e','-', '1.0.2')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", + "analyticRuleVersion2": "1.0.2", "_analyticRulecontentId2": "a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6','-', '1.0.1')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a1c9e026-9bb7-4c42-a3a1-83faa3ca26a6','-', '1.0.2')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.1", + "analyticRuleVersion3": "1.0.2", "_analyticRulecontentId3": "511445a6-6f4c-4e6a-a655-76c25b66597b", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '511445a6-6f4c-4e6a-a655-76c25b66597b')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('511445a6-6f4c-4e6a-a655-76c25b66597b')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','511445a6-6f4c-4e6a-a655-76c25b66597b','-', '1.0.1')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','511445a6-6f4c-4e6a-a655-76c25b66597b','-', '1.0.2')))]" }, "CiscoFirepowerConnector": "CiscoFirepowerConnector", "_CiscoFirepowerConnector": "[variables('CiscoFirepowerConnector')]", @@ -118,7 +118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.4", + "description": "Cisco Firepower EStreamer data connector with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -499,7 +499,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.4", + "description": "Cisco Firepower EStreamer data connector with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -870,7 +870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-SnortML-GID411-MLOnly_AnalyticalRules Analytics Rule with template version 3.0.4", + "description": "CiscoFirepower-SnortML-GID411-MLOnly_AnalyticalRules Analytics Rule with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -887,7 +887,7 @@ "description": "Detects Cisco Firepower / Snort-family intrusion events generated by SnortML (Generator ID / GID 411).\nSnortML scores are machine-learning probability signals and must not be treated as equivalent to a classic Snort signature true positive (typically GID 1).\nHigh ML-only confidence should escalate for corroboration - not automatic containment via BlockIP playbooks.\nPair with \"Cisco Firepower - IDS signature high priority classification\" and \"Cisco Firepower - Signature and ML corroboration\".\nRelated portable encodings: OCSF is_ml_only (ocsf-schema#1732), SigmaHQ/sigma#6237, elastic/detection-rules#6662.", "displayName": "Cisco Firepower - SnortML GID 411 ML-only high alert", "enabled": false, - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\"))\n )\n| where Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\"\n or Combined has \"is_ml_only\"\n| where not(Combined has \"is_corroborated\")\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\"))\n )\n| extend ParsedGid = toint(extract(@\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)\", 1, Combined))\n| where ParsedGid == 411 or Combined has \"is_ml_only\"\n| where not(Combined has \"is_corroborated\")\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", "queryFrequency": "PT15M", "queryPeriod": "PT15M", "severity": "Medium", @@ -914,31 +914,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -992,7 +992,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-IDS-Signature-HighPriority_AnalyticalRules Analytics Rule with template version 3.0.4", + "description": "CiscoFirepower-IDS-Signature-HighPriority_AnalyticalRules Analytics Rule with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1009,7 +1009,7 @@ "description": "Detects classic Cisco Firepower / Snort-family signature hits (Generator ID not equal to SnortML GID 411)\nwith high-priority classifications commonly associated with malware C2, privilege gain, or network trojans.\nThese events are stronger signature true-positive candidates than ML-only (GID 411) paths and may justify\ngated remediation after analyst or policy review - prefer HITL Gate/Prove over ungated BlockIP automation.\nPair with \"Cisco Firepower - SnortML GID 411 ML-only high alert\" and \"Cisco Firepower - Signature and ML corroboration\".", "displayName": "Cisco Firepower - IDS signature high priority classification", "enabled": false, - "query": "let HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Known malicious file or file based exploit\",\n \"Known client side exploit attempt\",\n \"Large Scale Information Leak\"\n]);\nCommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\")), \" \",\n tostring(DeviceAction)\n )\n| where not(Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\")\n| where not(Combined has_any (\"SnortML\", \"snortml\", \"is_ml_only\"))\n| where Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "query": "let HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Known malicious file or file based exploit\",\n \"Known client side exploit attempt\",\n \"Large Scale Information Leak\"\n]);\nCommonSecurityLog\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString3\", \"\")), \" \",\n tostring(DeviceAction)\n )\n| extend ParsedGid = toint(extract(@\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)\", 1, Combined))\n| where ParsedGid != 411 or isnull(ParsedGid)\n| where not(Combined has_any (\"SnortML\", \"snortml\", \"is_ml_only\"))\n| where Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity, DeviceAction,\n DeviceEventClassID, Message, AdditionalExtensions, HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", "queryFrequency": "PT15M", "queryPeriod": "PT15M", "severity": "High", @@ -1036,31 +1036,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1114,7 +1114,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-Signature-And-ML-Corroboration_AnalyticalRules Analytics Rule with template version 3.0.4", + "description": "CiscoFirepower-Signature-And-ML-Corroboration_AnalyticalRules Analytics Rule with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1131,7 +1131,7 @@ "description": "Detects dual-signal corroboration on Cisco Firepower CEF: a classic high-priority IDS classification\n(Generator ID not SnortML GID 411) co-occurring with an ML-only (GID 411 / SnortML) alert for the same\nsource and destination within a short window.\nSignature + ML corroboration is a stronger remediation candidate than ML-only paths.\nPrefer Gate/Prove HITL before BlockIP playbooks. Do not equate standalone ML confidence to signature TP.", "displayName": "Cisco Firepower - Signature and ML corroboration", "enabled": false, - "query": "let lookback = 30m;\nlet HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Large Scale Information Leak\"\n]);\nlet Base = CommonSecurityLog\n| where TimeGenerated > ago(lookback)\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\"))\n )\n| extend IsMlOnly = Combined matches regex @\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*411(?!\\d)\"\n or Combined has \"is_ml_only\"\n| extend IsSignatureHigh = not(IsMlOnly)\n and not(Combined has_any (\"SnortML\", \"snortml\"))\n and (\n Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n );\nlet Signatures = Base\n| where IsSignatureHigh\n| summarize SigTime=max(TimeGenerated), SigActivity=take_any(Activity), SigMessage=take_any(Message), DeviceName=take_any(DeviceName)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nlet MlOnly = Base\n| where IsMlOnly and not(Combined has \"is_corroborated\")\n| summarize MlTime=max(TimeGenerated), MlActivity=take_any(Activity), MlMessage=take_any(Message)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nSignatures\n| join kind=inner MlOnly on SourceIP, DestinationIP\n| where abs(datetime_diff('minute', SigTime, MlTime)) <= 5\n| summarize arg_max(SigTime, *) by SourceIP, DestinationIP\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project SigTime, MlTime, DeviceName, SourceIP, DestinationIP, SigActivity, MlActivity, SigMessage, MlMessage,\n HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", + "query": "let lookback = 30m;\nlet HighPriorityClassifications = dynamic([\n \"A Network Trojan was Detected\",\n \"A Network Trojan was detected\",\n \"Successful Administrator Privilege Gain\",\n \"Successful User Privilege Gain\",\n \"Attempted Administrator Privilege Gain\",\n \"Attempted User Privilege Gain\",\n \"Known malware command and control traffic\",\n \"Malware Command and Control Activity Detected\",\n \"Large Scale Information Leak\"\n]);\nlet Base = CommonSecurityLog\n| where TimeGenerated > ago(lookback)\n| where DeviceVendor =~ \"Cisco\"\n| where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| extend Combined = strcat(\n tostring(Message), \" \",\n tostring(AdditionalExtensions), \" \",\n tostring(Activity), \" \",\n tostring(DeviceEventClassID), \" \",\n tostring(column_ifexists(\"FlexString1\", \"\")), \" \",\n tostring(column_ifexists(\"FlexString2\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \",\n tostring(column_ifexists(\"DeviceCustomString2\", \"\"))\n )\n| extend ParsedGid = toint(extract(@\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)\", 1, Combined))\n| extend IsMlOnly = ParsedGid == 411 or Combined has \"is_ml_only\"\n| extend IsSignatureHigh = not(IsMlOnly)\n and not(Combined has_any (\"SnortML\", \"snortml\"))\n and (\n Combined has_any (HighPriorityClassifications)\n or Activity has_any (HighPriorityClassifications)\n );\nlet Signatures = Base\n| where IsSignatureHigh\n| summarize SigTime=max(TimeGenerated), SigActivity=take_any(Activity), SigMessage=take_any(Message), DeviceName=take_any(DeviceName)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nlet MlOnly = Base\n| where IsMlOnly and not(Combined has \"is_corroborated\")\n| summarize MlTime=max(TimeGenerated), MlActivity=take_any(Activity), MlMessage=take_any(Message)\n by SourceIP, DestinationIP, DestinationPort=tostring(DestinationPort), TimeBin=bin(TimeGenerated, 1m);\nSignatures\n| join kind=inner MlOnly on SourceIP, DestinationIP\n| where abs(datetime_diff('minute', SigTime, MlTime)) <= 5\n| summarize arg_max(SigTime, *) by SourceIP, DestinationIP\n| extend HostCustomEntity = DeviceName, SrcIpCustomEntity = SourceIP, DstIpCustomEntity = DestinationIP\n| project SigTime, MlTime, DeviceName, SourceIP, DestinationIP, SigActivity, MlActivity, SigMessage, MlMessage,\n HostCustomEntity, SrcIpCustomEntity, DstIpCustomEntity\n", "queryFrequency": "PT15M", "queryPeriod": "PT30M", "severity": "High", @@ -1158,31 +1158,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ], - "entityType": "IP" + ] } ] } @@ -1236,7 +1236,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepowerConnector Playbook with template version 3.0.4", + "description": "CiscoFirepowerConnector Playbook with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3929,7 +3929,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.0.4", + "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -5164,7 +5164,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockIP-CiscoFirepower Playbook with template version 3.0.4", + "description": "BlockIP-CiscoFirepower Playbook with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -6104,7 +6104,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.0.4", + "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.0.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -7425,7 +7425,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.4", + "version": "3.0.5", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Cisco Firepower EStreamer", diff --git a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md index f03eb58f337..c9230b4e413 100644 --- a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md +++ b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------| +| 3.0.5 | 27-08-2026 | Fixed Kusto SEM0420 in all three dual-signal Analytic Rules by replacing unsupported regex lookahead with numeric GID extraction and exact GID 411 comparison. | | 3.0.4 | 25-08-2026 | Repackaged solution (Create-Azure-Sentinel-Solution V3 tool) to pick up the 3.0.3 dual-signal Analytic Rules and Gate/Prove BlockIP changes. | | 3.0.3 | 17-08-2026 | Dual-signal Analytic Rules (SnortML GID 411 != signature TP) and Gate/Prove BlockIP (deny ML-only auto-contain; Teams HITL warning). | | 3.0.1 | 10-07-2024 | Deprecating data connectors. | From aee940754b3af4f445bfc13d118f34726357b562 Mon Sep 17 00:00:00 2001 From: aah20 Date: Thu, 27 Aug 2026 19:48:29 +0300 Subject: [PATCH 6/6] Add Firepower response evaluation loop --- .../CiscoFirepower-Signal-Mix-Drift.yaml | 47 +++ .../Solution_Cisco Firepower EStreamer.json | 8 +- .../Evaluation/FirepowerOutcome-v1.md | 38 +++ .../Package/3.1.0.zip | Bin 0 -> 48691 bytes .../Package/createUiDefinition.json | 58 +++- .../Package/mainTemplate.json | 316 +++++++++++++++--- .../Package/testParameters.json | 8 + .../azuredeploy.json | 8 +- .../readme.md | 3 +- .../azuredeploy.json | 29 +- .../CiscoFirepower-BlockIP-Teams/readme.md | 4 +- .../Playbooks/readme.md | 2 + .../Cisco Firepower EStreamer/ReleaseNotes.md | 1 + ...iscoFirepowerDetectionResponseQuality.json | 85 +++++ Workbooks/WorkbooksMetadata.json | 37 ++ 15 files changed, 586 insertions(+), 58 deletions(-) create mode 100644 Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signal-Mix-Drift.yaml create mode 100644 Solutions/Cisco Firepower EStreamer/Evaluation/FirepowerOutcome-v1.md create mode 100644 Solutions/Cisco Firepower EStreamer/Package/3.1.0.zip create mode 100644 Solutions/Cisco Firepower EStreamer/Workbooks/CiscoFirepowerDetectionResponseQuality.json diff --git a/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signal-Mix-Drift.yaml b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signal-Mix-Drift.yaml new file mode 100644 index 00000000000..7a229095cd6 --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signal-Mix-Drift.yaml @@ -0,0 +1,47 @@ +id: 6ff65bb5-53bd-4ffb-a62a-25ea71c04eed +name: Cisco Firepower - SnortML signal mix drift +description: | + Detects a material increase in the proportion of SnortML GID 411 events compared with the preceding seven-day baseline. + This is a detection-quality regression signal, not evidence that an individual event is malicious. Investigate collector, + sensor, model, policy, and traffic changes before modifying response automation. ML-only events must not trigger automatic containment. +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog +queryFrequency: 1h +queryPeriod: 8d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - DefenseEvasion +relevantTechniques: + - T1562 +query: | + let FirepowerEvents = materialize( + CommonSecurityLog + | where TimeGenerated >= ago(8d) + | where DeviceVendor =~ "Cisco" + | where DeviceProduct has_any ("Firepower", "Secure Firewall", "FTD", "NGFW") + | extend Combined = strcat(tostring(Message), " ", tostring(AdditionalExtensions), " ", tostring(Activity), " ", tostring(DeviceEventClassID), " ", tostring(column_ifexists("FlexString1", "")), " ", tostring(column_ifexists("FlexString2", "")), " ", tostring(column_ifexists("DeviceCustomString1", "")), " ", tostring(column_ifexists("DeviceCustomString2", "")), " ", tostring(column_ifexists("DeviceCustomString3", ""))) + | extend ParsedGid = toint(extract(@"(?i)(?:gid|generator[\s_-]?id)[\s:=]*(\d+)", 1, Combined)) + | extend IsMlOnly = ParsedGid == 411 or Combined has "is_ml_only" + ); + let Recent = FirepowerEvents + | where TimeGenerated >= ago(1h) + | summarize RecentTotal=count(), RecentMl=countif(IsMlOnly) + | extend RecentRatio=iff(RecentTotal == 0, 0.0, todouble(RecentMl) / RecentTotal); + let Baseline = FirepowerEvents + | where TimeGenerated between (ago(8d) .. ago(1d)) + | summarize BaselineTotal=count(), BaselineMl=countif(IsMlOnly) + | extend BaselineRatio=iff(BaselineTotal == 0, 0.0, todouble(BaselineMl) / BaselineTotal); + Recent + | extend JoinKey=1 + | join kind=inner (Baseline | extend JoinKey=1) on JoinKey + | where RecentTotal >= 20 and BaselineTotal >= 100 + | where RecentRatio >= 0.25 and RecentRatio >= (BaselineRatio * 2.0) + | project TimeGenerated=now(), RecentTotal, RecentMl, RecentRatio, BaselineTotal, BaselineMl, BaselineRatio, + DriftMultiple=round(RecentRatio / iff(BaselineRatio == 0.0, 0.0001, BaselineRatio), 2) +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json index 0107646e0ab..37f60e1383f 100644 --- a/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json +++ b/Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json @@ -10,7 +10,11 @@ "Analytic Rules": [ "Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml", "Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml", - "Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml" + "Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml", + "Analytic Rules/CiscoFirepower-Signal-Mix-Drift.yaml" + ], + "Workbooks": [ + "Workbooks/CiscoFirepowerDetectionResponseQuality.json" ], "Playbooks": [ "Playbooks/CiscoFirepowerConnector/azuredeploy.json", @@ -22,7 +26,7 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Cisco Firepower EStreamer", - "Version": "3.0.5", + "Version": "3.1.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Cisco Firepower EStreamer/Evaluation/FirepowerOutcome-v1.md b/Solutions/Cisco Firepower EStreamer/Evaluation/FirepowerOutcome-v1.md new file mode 100644 index 00000000000..c3ac332acfb --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Evaluation/FirepowerOutcome-v1.md @@ -0,0 +1,38 @@ +# Cisco Firepower response outcome contract v1 + +This contract makes detection and response decisions machine-readable without introducing a new data store or an AI dependency. Playbooks emit the record in a Microsoft Sentinel incident comment. Humans remain authoritative for containment decisions. + +## Record format + +```text +[FirepowerOutcome:v1] signal=; decision=; containment=; reason=; ruleVersion=; policyVersion=1.0.0 +``` + +Values are deliberately bounded. Free-form analyst explanation may follow the record but must not replace it. + +## Safety invariants + +1. `signal=ml-only` cannot produce automatic containment. The Teams HITL path requires an explicit analyst decision and records that decision before any change. +2. An AI-generated recommendation cannot modify production analytics, policies, or Firepower objects directly. +3. Candidate changes must be replayed against the cases below and reviewed by a human. +4. Every promoted change records its rule, playbook, policy, and evaluation-corpus versions. +5. Ambiguous parsing fails closed to `signal=unknown` and cannot silently become an automatic containment path. + +## Deterministic evaluation cases + +| Case | Evidence | Expected signal | Expected decision/outcome | +|---|---|---|---| +| E01 | GID 411 only | `ml-only` | `policy-denied/not-attempted` | +| E02 | `is_ml_only` only | `ml-only` | `policy-denied/not-attempted` | +| E03 | GID 1 and high-priority classification | `signature` | eligible for policy-controlled response | +| E04 | GID 411 plus independent signature for the same flow/window | `corroborated` | eligible for HITL response | +| E05 | malformed or missing GID | `unknown` | no automatic containment | +| E06 | no IP entity | any | `not-required/not-attempted` | +| E07 | Firepower object does not exist | any eligible | `approved/failed` | +| E08 | Firepower update succeeds | any eligible | `approved/succeeded` | +| E09 | analyst rejects Teams card | any | `rejected/not-attempted` | +| E10 | Teams approval expires | any | `unknown/not-attempted` | + +## Controlled improvement loop + +Outcome records and workbook trends may be used by an external agent to propose KQL, mapping, threshold, or playbook changes. A proposal must include the triggering evidence, a diff, replay results for every evaluation case, cost impact, safety-invariant results, and a rollback condition. Promotion occurs only through a reviewed pull request and canary deployment. diff --git a/Solutions/Cisco Firepower EStreamer/Package/3.1.0.zip b/Solutions/Cisco Firepower EStreamer/Package/3.1.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..b154e231c7cca172ddc15fc11747e30421ccef2c GIT binary patch literal 48691 zcmV)kK%l=+O9KQH000080Og$uK02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?OOeA+c*;czfVE9cZl7y>?G~Bhv2%4Tt3|7E7dAXZuV&J4E)JA>V*(BfK(`S3ssZpA-N4#imJ(n^&N&St5V zKW2lUjLPqJ`n1%P=SeCwEp;Yit&AGm!M-W`h3f>*#ymBmU%j~EM#iQ_if4&1v6h7`7yX;eCd}yg@hF%@^Z8&R z?R0iEGeToIOQs>CI34`|qYFHgxk!hw5(FHcs);hgSejTxDgKTg?G|qb=6W*fu(?d^ z6e~RXrg)2=Qz0i)8-9N~%18OVd*3T7_U_$d=c(XEFfGPHGpm@L3N}`0s^&7Euq!cE zS}>U#%hQye(0ilO8ELe~h}VDr{U7$+S#jkhd-+^=-n5i?)vXlv%5K)sY9T5$FG^-+ zctEQDd3XC*YEh`U(D?i40<`d$9+peFl?GYTBe@s}b~zQ0KjRCi!d||~)jVg?m|0yQ z{svKLhNcvtQouNBPuydL(3T?#$pmC2X;>v(pB3vy%+_r;AgLe_d+C&6L6xN_^Z9(> zoa(beS}~OQP~^ixt7H~ik}{rYX&1vWzMg}z0YxI-4yHCsdrVX&3DUuvnuWw*m6_RG z={E+kVyBfnN7s1ADh90%bA%T`gd*DhCdw+_QDwmhQJjm|D&1pUq=;hP@Z2or>oKG) z;}mFyE!2$6X52e=v4HP07|!aMarRAUS>*1*eN=KM-4bp&8*7y8EbRzKb9RtQXB(j*1=~MA0ShB1Ie3wIDefCSW#2zJ zei587pg^oKjXggtenxOv18xYe6x@XKfl~|WU5P1A$4rgg3Ku6wXQT!4eL`^<=uF!bjB^~9vmI_T;M?hsIvTq7A*uq2gGVKgYW?%Q0Sujz`Io`gFimdN$&@@S9UySH?m7Klwa zJTWWu#H}voK_zDCjknTRQYVNHPa|RZm6}=71QNnTV2&D+u&V{zpH0~Poj%*$-hEIC zb4Z>Fj13{`ZXd$EKz3az^~OEfp(pz}PZw6k?D;Ge?(qY9d@wT>;p;Gv0o6gUUlgXn z({VUY`6BSVPwT%t6r=~$d=buANLYhTs~SiOut1ME6qnq^iG!?Lv{H+{#`liX1KGeZY>1&@Ux zH1%r_IXVaHJhGYD3J2$a&9u&gj&MxK)~V6G3V+|!OqHsbx0wlj2qze5Jg0s~CP-T9 zCZ5WK;Q{e}1)?CWg5kVq!0 zRl4$#Qt726;X4i($1G^nbVyaL0~76I&0ubBCC$?<;3-% zx|@o8VyE2|({+0TQm@zF?!D@)*w@vCmYA3->N`76jxJYX5Us17y5+DqqM=*QK&&E@ z{#GsOKQvLknk+TZNE`G>j9*Pp?mR>dLug*tJ{uS81J ztr1Y9craCI;i*F@fDC0&m_{w%z) z{xWlXP<)N(ma((->&V-C)Y%(#w)%|7+*f_JHR|+79Vbcq+nX)0ezh8$6wc_2k~J`> zS!)S9H4-0NuS%3aS6I9UBnUB=<-9e38Wp=vbCvQ$TuST2co!kOO_iuwx*9;;F4RtB z#ar8~ARCk662yN8!oO*Lp$cCEoArU1(E?R?Uo=`NeM%EH2chN!>LE29e~I=V#T+L4NZXG z%kArACKH~=)M=L6f@Nn(8`eQ*#dJ5dUn@oNgB-j2f5-kY9UDRHH@lzJv9vEx_ghthU9fatjsB7=vJB2cK^|M2j*E-~zjU}R0xZ4$n zAk!B{kLC{B1nYE7k9NOPkrr++GeLtvRIWLssf-^ITBoPgi)zP@Ju+qE8W_A60`M4H z|Cy=YRDyh_*4tv^ZP+8Gc_@-%|T5`RX7&@PQ{k-oPu;?4)#@4}Dln)JaC z&GK_7Y&qnk!hn9efRP3JVTMe#izb^5Nw=;+yB2N9_ilAIg@gNQb4YlmWg;F?AC1kS zS*yKCP@blYJVlOWfGHX5k!Xn&n@=UGWkC}eeH{{ukA+<@)QCLcng-u?E=0~Qa;5Fr zDSL8q$R6zMp!BBPV5{Mmur$}{m-AJv)s@n2>?LT+h)O$X#!oYXn!jJ&X?yb_1tE+p zS_{H{+uPq*5ZYGysDjWc-0ccNkm;)zgw>;q`Km(H zgfVt@8o6=J6#WTvn*UlteAjLTHmnZJ-Ji5Qz>(de$fBM7F(7$&d?%sdYXJBbyg<)tbA_u*9A3l7z z`*DT+7NGFqJLubk!iPKO(}F|m%;(+8eM)esGV47cQMU}fT15lO6J#uUOeAXqTzjM3 z%}P!4wc{ls(1 zz{@E**$T<%OM`d$1RAZPMifvZMjlb0=Fe*K02bX!14bt!C0y|Z`w5UG$BR)uabjvX zKan0Xxa(t_XXyw)BLhUz%5}vZor)w=!UFMe8vep{_cBldvT7n+1=P5RR zUZ&7|&_$&n@a6dz%diJups6k+FOzTmgyGZX)`PE`TO1Vt5RZKm+Gg688c`kRqQj+r ztGqPSMC7s{(F_JfsVr{(GZ71S2g49el+Zmxu*Hs0xN?Tzb@97wyngocD+KZc{kB<- zc=|s0uB#}cGiOe_@dSmFV4=Jl27aikGL~wFm_5m_DZ!}tRC8FR`^Z3nB-DLuITHca zzLfd#j@5iTrj{5?M)>iuq4vj({w+@ZY z+ur`hp;6mPA2l>;74CLJqaf4oVrWz;w44%!0|ki({%)o_I;_qV*)xqz3|*J-L!4S*se#C8`zT4uN>I-*Wr&@l#T)A;A$X)HJ zbf{nJ>8vPL{pi*ymUpj+q-Cx04jEbV=FZKX{{c`-0|XQR000O8<((T{z=(JTAFu!b z%z6d@5dZ)HZDDC{RAp^&Y+-a|E^2dcZtT5zSL({PDE|NX6nUOIo_ZDOLDxBJ-;H#l zg0!NpwT3q&1w=yvX+Yd}zwtiA`-Hzw@~f&eBq2RuvrNtzYhzOFtT|`Rw(75c5X9bp zh}0NN$h~jG-dK{R;Lz)TK>t%dPk=cuoRSoXX@mT4Vlif@F~Nug4FqNmyBrGq1Q)+95PF3@b=ZI7|NgBm(|UV;;A(|n zKsfz?NCrDQ*l&XoMhl)$kdhEJOwpD^Bw{f_1PBoj+MtPP1BI_yK%rmz$16lR*w?=A zA0Gbln6z=O&U13aE8$bvhOI zj|n4*>mMME9}|XFI)IV|h^=}Prct4040CdtJ7yfV@bLnS3q-WNwlf73!rr8j5jxE6 zct7qkwf$qS+A*4n?H|h=Gn0YB4G#QG|IlF)DiI}hvA`ZostnN-cv_}(Y*I%nk9A(;M2jn21pib#nDwP1SOb#w735Kay zGLuY#K_;C#&45)y#&$HmYEN%#=u}{VAfb91rXp(D_tX6fuQda`a*lnkM?{FxFK@Ay4{6@!A0e} z2N~&&_@EzL)|qfJUWAkJJy`pyt`w88r5HEEKro8Q_@S6L(fb2ZOvWe0gwgfihGH__ z6l0yF)}M8fA?7HCpQ9EcxIV|VvV`4Nb#m(5^cW&Nj111^2cGa+n3P`^b$lxDbB2cf z#8pt~Mlpk>Yswe`jZ%qJS_!(0O$9J#z+zQWjoNbdHLs~jCX<>WT5s=%Edj(EmAo%tBJMuO3BdKR{1gxHXBND8l`hMxtf@=eZB{7CzF?G78_%p|FF#>^} zpfuPM3q~5RqE+Y0k`l(iG2HxwWH@b|Odan&P*?AVS_{~9M5&dY_siUdInMTP(>GHX zp83-{b!pFEroW8nz8S|47QJQYe~mDcu|(RAF!dT6@CS2H%6iiwiC3@x%y5`JR{;kE zhU(SUi#QO35o?s;_0*Un+hVXFvlij_Xd8oQg&rfZ%7T{w1TmZppnt7}d;^{S<_t+( zgAqwBiNXjjqW0D;b z{1Erhsg>&l?2Y9|Be+|xBA^*g838|;z`x44i3%@FNQpQomMe!R_ER4TrTlk73 zWW^vffGrym8rXtlSpp095LNIxud@uj{_HJaM3{>el&J9kg-R7zr~o)Z(SF$efx!Zz zPO=LUcKxvcfj}^a&1)sB1KklsZe(e|%N$Mg!GP!rYRWA4@oC=i_<;eu@ysv=h zG7~_2Cnn^}0s4uzezd6`u9{;+jz==9w8TXYH(dZ#M!<+)g!6+ej|{OGnjlpZRhdYG zpCh>EYKn?|N4Ut_0sb1UJ#1fFddD?@5*G^fAPm!lWv#XUAjlDakWSDJs{_|!!&M{a zQ0O2B40gEN3w3B4lSoNMi?HVo0(guqkHC-S(i|IblR3YTL`6xR9ng zG*zM5Wwo6UOObN5+P>vCSeyx)6b<{!44aY5G_Sy$XqhH%X9zbHgaO0L|Y|K^m|?FX>p&4zKZh zr?$6@4RLV{*N?se%S{l&hz=4@C~XqYuu)UCo011;!WZI42PmnXG*8J$*H>~IVJj>k z1&)~Tus8{&0Ljn$bT#gkP)2eKw$yMpp>4Dv|^Dtd8bL4c!yACZC;TR)7a za3eg2>{=57aC1iBImA|ui2~vVXwW?D8d)oNnHEo+#1I!2>>utaLc?Bc$|zSfBt@g( z3`iVi6^u=<;8Rz)9Wte0Ly`^?^9rp~lfHJ4^D?3Y*Fzm4l;seu2uos$^cy3+=tKl7 z;ZE$!pI4&hpU2#K%H;Iwu3p4IaD{#0|edYLLT1qSL2OSl0# z6P5PZ%I=o-pcD^Sgz0UWvtL7mcZ^|wAg5DyxlU`}e2iaLy7th@5{nU#h}aE5f#IXt z0}xK8OF|Pm1afgQg3y!)ke_K8fmrsyd`9^tp$6jr7tL2CSMh>d7Ep^jY z_IizPDL#Z<*qxkZ4ukE!K_Su9YW_aP5-*lo75g_j#R8(P44czX^~Xqtg5yenT`U$S z>d6Zbf2cU%;<6Z*Xe`;rwH-08AIK2TiIE~ zI6E0j6V}D#vsDQs1tpLYzu;J&q%C07sX-B=6p{+G51Jar{%A?}SgKBjwN+brI?-y` z>{>sNon*B_%CPYAU}H*0Uz2Gpk&WrfM@&>3i0M5Xo)AQBh<7TeCg3ef*_9LuPwQvf z{Lo$)P)ciLDejF=VOcPwRj4XCA``2<@-Vu7hcea%sqf+|g5Mgdg}WGEyKPT-;-h@OaJ z{N)fe0yr#c>X8v>xm8sI79ka9EN#Q`4LG5wev&->m{^fc>=r9BL{Z;B6$oPs5gxCi zKC6pGI=a1`@xZ-d+QCX{$1R76u1I3@0PrRYw1QG#WU2}Z(xc~<1n zJCT8-!Bav?h;D39CxdZb#O%tOE&W(Qs*EA^(Qwd}Gldr)p(Z+0lRmV5ris=*LR$G=8q3?tX8Yq~z zH#hE!tBsJPAXmnFrN(D?VMKDws}cz)8n;X+)-QizGX8PB@)P~B+Stfv@?;{$F(U-- z(G5CeGAD#m-pp76#1X8$vz9XdZ2|9E)aV8=nEH8?-l3pQG1_{KEd{Ttwaw>Op@4Q2 zUUDE#p&;&jewUiT88=1m8^-7r@CnC^<74qW-aXoT!($muGtTLzM!%p*JV>2@-Wc9UTg zCbP(29!7xt3$F|!&&(l@jG;A4o3)KCt(tpAP?QN|173d_K-vm)9f!t?%|oi zYV}NpkVGS$)`FQfGhdQ;0VZtK6Iu=zzhv%&ztvQ&i}ABvh{G$ zcR4&i6&;=*9iG3H!}C+W^Wpia=ylK76CCGv!OWQO2{flGI= zU(~!O7f|oUNkzx|`-iJ;4DpGEmNq`7Iy#X*I*~s*kv}?-f9HJAv6NvM-hf}C9#)Uf z7;$rz=)Qn$qQ$OPJ9rd35nV^1*Nmi>nu=zokBiqe?fdE{{NT7ZhT#fp zo_43GZ`G)S0jLJUX|K%oR#91j0Wd(_7SNc2Z6U2i9L3c}V-y(1p!D%iNE=)XuJS4r zDK>>L#}uhVTH~)YB{&1g9)o@F-pq1%Z=^tt@fN!835k8H zR|L^9A}4~8aD!kG)LSt_=T@h*mZ5p5TOk}#zNQSn0ztm9Qs z9|sn=g#$b#Rrx^kY|AV-#12VGgLMsu#|Qwqv7sgdOi|JkhGQo3gh-yG^2X>)%$sm@ zZa`+^o2@IZ9)+tb-%)@N$r6X^uA)XftYAmWQ&x#IL{le46!?R~hDa2uiCCywf?8sf z$(#_HGhcJzt73$n1B39;9=Qp`3D?QkHrK+>{U+;#jfvX%Vgcpxyy+k?*`NCh`Uy_k zUpM&L1~xt~7znbC=Cy?UaBFuC7}}3wxOaQ|!0Pd&Z1e=h3b>DL`Dy|~FHtD?PA@4~ zJv%`SD3R>w1_MKHQAGJW-DR+Pc7i;alkHt}U}!%IO#ecG>FbZ%ja$m|_Tq8TKKeAc zIQ%gq-#<&>`y0f)@8p6613m=05795S;+6y6ji}bz^_>QWuIzKDH4gF!we8);zAF~h zxLb$jIC$5g#gM_&4?pv{`36hEwsf#L%XIzjR@>hd4>gPFvI?O&4RO`OF5-JWbRNJ8 zk_K%qy0PKI-q?`(+BY`XN0Sr5k9&5Al-|jW4NiSUH#S5!HsFy&H#P*N*EhJa!JPfD z;YAJB;Rn5_!CF5k_xXnr6{Cw9yf)M@7d51!iyFf0;2U#-ZC=!1Z9BTCLHqPIE^0_c z7d33{q6TaBV01sjZ*xDxr_2KUw6{M*xkh1fjXurY6j9DlboE7a^+j~`MRfH=boGU) zXms_(m&!W(+*e;%xQlbvm;(#Qad{m&pd(-Q_F0J56$TSzJM~w_I`w-!5A# z%F>Fmw4y968*bwi4HYIec*|K>QTCPX`uWVd3XtKu#Vo5RyK3jzRjx6Leph`LSyWN> z)ULCqwzBlQ%#w<-quwt&YAeXG-7Kgm`{`?DKRE~B?@rtdoYfR%Gey}<7!LwuF?q1j zKv_#~kgfFfvXnfslY(a@gsYl`$|RGq`t=RRE*~}7fMn4k zhz3~!{r&sgIpU3gYQ^N6UqiA^u50*GVBvZjsl+B)#Xs3S8ei+7=Se>|lt7|Sxn>CJ zap7PeiHH_Uj=v5>}S`Zgf z|(a3<0JRMM0LdFibm5~I+l2Dwal+h>+NO&U@WPnsXs98e!^8g|gB4{`% zG(0@G3y4PqB!28c!aFDpkU2xuS|P+pOyNU(mAe3k$!ne=JT6j}c%%%X+;1OK^$2)>+Op1_sKyaDjxQ<~(Rq)Y*2$h$WZb|upqR)Ts z9inE{2u(Pu0mI=yNGMODga#$RRpQ~FaE%V?KosHbaEPkI{~udE7j!#HS=-D-$Fizs z;`CjaBlcz%5&qRmP9?38q;QHXcDZ3|f7Ohn)8Seh^4XI{5SF-obw{hX?=lZN$+3Gt!vtkDouq$Jnp`V(3Hk z^V|1d|9SB9Cw+8?`bZw@*mQWf!dycq-!WzJ!V2pkBEzw*7=RJwA-_9VFSz0_fHtEt z3L;h}UWQsC3gA?!1`$1EBLY>MTE2G_QL}kWltgLmt05e+)#mkN|Ig?3=5O> z6D8Eb-uKzqWdS(c8f#~uSbJx4aQmKwV)-biG2s58=uqHjl=&v`tbKxf`DMtkl8O=j z`UTXOV^AiQQ`g;OBA>MH4t~lc{q+Md9o5O{6p1v!mUGAemiDOXTpc%o1W4pJRYGAa zGRtBa$HkzjY#N#*WMvxx&pCHMJq0LTRii?E_`Xp0tw81NwYETNjh*fSRJG>k2h`do z^M-(0C)t0vmG~Iv{a{u84bS`0jZ4Vz;CwuRx2>i|CpS0&$oB=j7Gszl&o&=M5Ofm3 zj`7*hnq#oem=+?y$v$DNXlkp`VL#DfKX@e3VLw}-YU}wwPDH(B8jDBH<9!> z7--`rx4_RnzsoJ<;c`nwF1PKv+-jvxOgB`=kPW`68oIx*-_44J+Ob2wx8E)0$kS85 zx!+B5T6y^2j2F5x{5zUCtVLN$0{=vE$hp-W0}*IWLR3?P-?$N+k=Y>^(;adY z$DLZf(&7ai&_@~2v(1yq;x>=a~!FzG^n}kG^ZZVdHU?UC4^0Ub)g(*{@sWh zI?z}k5k}r!w4l~^f?h%LZj(T4V#qhGIL^Y#K9rRyxk`qmU7r2=*(pn|;>?;up zV_F%4RHkSsdrb;(h8?(F1EOXKj=l!uGx8n%I{ep9F7mWSp4NBvw7SAw@$|j7H}-$& z-dINDWR^Y9KOH*zU^QA$_aSA%BKl*ZQh?EyYwUQv6&GHvp0WkUrgIyg)go{3r}GA* z1&w^ckuNxaFBp#S%^bn0L^^T=8=lA!965p=D@2aqui*%`8V_r9>Kz=xsm&b0Hj~)Y z5gf?8xD!XPKeMjdYUBux9Km=bkt28uRJ}b%a44H<2#2uK#8!8`1a=4qY;p^H?ejZ? z(;g1tbmS1;at@~M42HU9tbQFU8a*Lj*ePtqM73i2_jU@W9r=6uH+KrtGRel23`k49 zA^g8}Un-U>-wfH0W=AjDvMgDH+`9AF>NAF&#&`-YEHaNPgk|HH)qK?T>qEuKsh_wk zLOA{86s*EtDtcvD#mzAs9I-e?d78>$$S6Zp-&v2=yr9a(F1jn(==0Ux$7b&__8B9` zt>W=DID4`4cL0XyD1-I%Orpf={&Wd>uVM2f%X2^(lb#xiP7Klq+--);Zgh41Zox6j z!Z{5f3n#u4>BQt;Ke@?B00tKNvtq45y`-?8UaYg%=OB6JPr zkUcciJXqaa6vh{eo)G?6R83wX3hIck1xbu@gT1xZe$AYWe{CLL)zCxbG112Nsuca-xAq zM1Yn(Ygf{L~e+jQ+%s5Dk+p`08RsEM8#>pItv(Os3Q}p07j~%PCe!MSn;^eHP<@2hlJ$d0BHukLwW6Z z7^poxi51;bI7gP!k#cv8da2^^PfmoK4gMe|JPlyeN(%U~avzp@u{$*;ImmUiC;(WJ z87|RW;JBtdY{8iPt%nq-u+UGVR&9dzr$29Y+_4(_F=1W^8nLP^gaYW@l$B|G*HMCb z1=tH^<47h52UqfU>`OkS4~=D9{K(cqTk|BNh8_LEj-FtjPGA@RuP@hcXs>T*hwsL| z-imYR$ezAiY0Q&;l4Er+D?gUfR+pDZ_B+MPaNZEI z%FDX?h8db&(E41IVr|5>z9SEsp)E9}#4!OiAhbX791 zb8qUc5$omgWmf86D=(*UMIa8O5_nrO4;#KuCKA>U!_sr^syPr?8pCrhbY*y6{f?6#i@wYO9f-BJxw?f`szD>`!(rS~D0Pb|jhJV~VL0%5M*5-yTM05N-j z%mAdY)D1)yN5iq6zo=)`iN|V!)hdEs_Ys^}1&cM=$Xk>*Z*6M}g%&y)nmB@U?;Wzp<0kfKHS=?5%`uoC`E!q+MV!N1^pL}9r0 zKV6mq!9{mfsBV>?s?$XqI{_ys!BvnMaSYc~bz<1S*$vD@S3q1FALI)Z{8*uZ`2YRi z|EJ!5358nq0%@EBYVQ&Gx%W4mErKYXAUbpx?MmqN3Ls}zfEXcqHDjCFGSwh3b;zz3 zPX#YS;|duvkxLA-=@>mA^RY~7n2QavXLKxcmO4Ef02)w3fE)1Di#~K@N^2t*5`L|Y zJcCwPY^(MY_yQesjG9K*xhr#_Rclcl4KtU>oF>rox7tPrNNB-CrK|{$M+Se9rNG#y(leNWwuj>WkozwY((oS(@ns? zH7=~a`nfmJc`U!$t(o=R+JXwke=!GDosYX9)3F-`Hiqc>`w*gy90M45}|UMSORI}enpfYlSTZ*V@r zF(VntZ~2t3@;0ufkoCg$msaYTR-($#-z~nReFs;P$(girCt-)u{&DiSXl_{vE%{E7 zA~+~wU(voL`3nxGX!_IQXVNRF{v}vmW!d}3I2jfn28)h?g}A4&ZdjiM6_eRs>iE;LqlQLSdy~E#Z05# z0&DuhEa~fz;!ksGqL~g6-K?imCdW!vEF3znt&^D9y-J!1En!D!$OeNiG(Z&g@kng~ zD5%#+_T(lZaWf*ck4iD`y2F+O1VL3~1r5W=cWOSkfz zD7y9E_Mrp@i?7+rwo>>V96>tVSKx9m8NgwK5wFDLX+T=DWJKQHeQi0N9lhF`VjJA{ z9J+u0r8SI#c>JO7zX+Be!D6g(Vg+`K#n7u*J~e$g5$B_S5r%HQe=0j09J&^tQNk8{ z_!a{5duItLY;vObKz{sEiml>B+{>zHRGT1!y9PL$awwr^I$M5v&K7Ipw$Om{(GnqJ0>e zZH~V0(U@41j;w`x!QZfSChRaao44y>b5WFrR%P=j4NtymjmEHHtD(JBp1~LT=+NoZK)GfKk5jQ13;hYlWdMK@=!+^c2~-?B>4J zDfHUcPBUniJ6)pCta(hp@Rv)#i+ProL0IOn_h|Y4!-!snZ|m~*o^DF2(W=2_LKUFk zs#%@8{4?NglPjFD|7;ylfM!jD^;s{#MA~48QX?GZVfpHJ8taYvnuWPqph?VOodP}x z*=`c1ul^@tZPe!^jMaQjq6ApTz!c@a(keB~ld$>fXA<^}dQM`!n$Jm8f#fs;>nA_M zw`tCE?3Ow{2i}w&2X6i3XW%x?c@ErCCk(_z7m)kKd%FgM0o^~&H+j(+?AC9-;BM2P zH{dOmLJ+KavU^qF<*75_T1o{a;Pp-d5wf{@Q1o)1p;M7S$QEL54t0YPyz|7IiUeW+ zAtvTfcas%!Vhq+Yq1P-hqp(yC%rIP*&8bW<1`=lB94d!rD4x6|JR1qmK|-UVI}(OO zzmSL*no+p(h>+|dBxeY{5+3{@EGr1h1vX#+9<(2p?88!gC}PJE4$h>meGW?KhGqki zxmqtMYT3+U?OPzE3Nn6crJ%%ZGx)V{fe1Uu;H{NHLEed^^^d_}ADEoAT7ik#4*Y8$ zgAsC|1+dn#nZUX!I>vD53=U&l$Nmq^%#64GgToWG@cuEe&;7D#Rx@p`oFD#;k9uXb z){h_dM(#cs#3^hAEle4!QQO8my1yPOVwgVX z?U)_UTTF>FgU~x9D4B~Ta<(~VI{1Egu7X$YoNbVm6+J^8lc%0g0$XW1Th`UGvIqpu z-l%Q?r-F5)-IQ;ZMIQoDs2H@@(5LzYmUOq;|wrR%}B%Viy z_TcCM#c_s>+}>S7Xri0e7*28mqSgaBsG(p1SSsbz8fuRPq|gN~$d-?jsGN&x$JL-g zqoTpim$!Rs>%8BalA;JvkbYMr&<7C&3A9R^A%S<-VUQs06A2s+OVZ2k01MXM*+sIT z7+Jv4st3x6fr!fIp1`j2MT_&wcVy8(Akj4`tP&yf&mn&7BB`u_17Wx_^8Ul+?FkHO z0y)aQF(`H~KIKOLLWh3lGRMsA`AvI~xT=o$0(=^s-niTw!CyBN{HMef3pM!P^BF5W zq)~ywU8B=Z)Cz)_p>i$sqRq8>$@4;?`0})vpWe56=;b9<9zReE*n(Jxf96XCik{D^ zs6y_t(`%pKUW`HhA(4MNPhM8;$-8l8oGJFIr`4CnsF<153Pn&G)eASzg{Qk>=PL31 za9$W(mu?zjqgohWkTt&4nq(`P2l8m~P;W9)D?vV=(@)D}_W72}*Fkl_RIY5wUb9?ww>DG!D@`eJx{dvdTkSPt#|%FVN|SR6O1oC+EW>aej5X%$&w=uCwE_ z`042>KhLLLnbzyo?L&N?pU2PmqqF&3xO+{e@4>JckB_QZaF@HC zhPQXGPs!FPbrTm(xw~xn4#+}kni~l(=^-^-o(=o;Dkr^CNsh~A`NGR^E*vGVYQrn) zDI1sX?_O>z;Es7(91T0gN_TSIO_g5Gq}iD;&j`bK>fy4OElut&5t-ADy1RCLfZwH8{q4w$nYI=BapI7^d6J6eDF>Iz3Ii%!_cA1<9Li_jQ>#yGb|r41II=@(dwzbaRnP zJ~gv7emG0c@?w6P%E@UqLADYDdj48HnzH#+{JJ7sPjZqh!xgJgcb$~jyi3kg$=+T3 z`R;Z}(oc1AmK?;h`PSJT$u3V%n-@~NozLD(XSrmrNhX=hS&!py?%1O{A$51Ld>wZO zd`&v#dM`AYtkARbwl&lMlUoMk156EW~Ti7b9xPwYhm!4AYP$a#pG&PqVqB*J1O% zcb|jYlF2Tg64|8CO)TnkF}JuV2$wYf$_f1oA(xuP!J;@$)TV6tp+d&xYU7;lkmvX1 z8;+A(WKotnv(iQKifMwz1Cy&<=liWYnM$@2^y~=Si`Q4()-_p86#CDSaGESU#4ih- zJXuY`wQRCfxp_sGLAY;KP^!+`i*i#=F)31N-3Vl^DzayA#WwUqLl$nkUB- za4rCPK!v~8q|r547CX!7CBr7#5DwtF#GYQ?N%P9-1v%@TO>3FT=tAwzK>-#Qj$4ZqZ8c&-}|E-AV|F zR#ln~+L_tt<*ZX1!*e*KEJ-4)$h)p&ueFpzmb#7@G4USy-xXF z%JZO?t6lUH5`TJIxQ|cEttH8o(SMtekM*;&^75!yW}n&W_0h7-0!Rt^nmknNeQ5#L zrc!!o@N) zaWI%4weAy7*>-Iz$1lszUHKJMuabQ2D0z3jKx039=H1g1f5FABo%xA7`XndPJYy zk0t7^KhDmi-fc1|KpYb0qZzon=<`FW3*phM$k)9B*A~x8*Zt-&eZz^1+4Ev@Kdz9M zqxwaoC%p^`=K_6859t?B6nf9ka^)g@dC~9DNpex0Etiw?tDAAHIl4_<-ah9C`Oe~u z=}*Rk{_B_~kK&CIDc_g+56=}LySOALi@wCQB!18)6Eu@Aqz0W?ypvrH@^z^&r9eJ6 zC3EtXlu9+@wTHrNa@|hl0SA(2Ihq>X9TktLVVXPZ#D&=%o9)x{VQPMt6_zYNXmS_w zLTYAv#VJ>uUf+%Ac$|*Qi~MySGWFBU*-^89(T~@X;GvRcr)Q^m@ov@uzQ;L2P9-6oDwEUXr z6>pam1Pz;^v%T8Y!`*c%F6N)PRIhPf5U!s`H-+l3^pv^o#0Rf@^1gES($8k7ezBQr z%U6IGhV?`v@zAf$tGW81CtQ};(OD;18Kp|;*;NNJE%9#A$u(;C3AS5ci)^NtqYC6b zd2z*#Yxi`rG=84kmfJ$F53-{pP+nFa3T!7q3*EE);5H*akFSQ;=QWZMJIm&kQ17>= z7fj=NQaGJo(h2^x2&7*9nJQK2b-Be&<)SS27QG5vW`+KJyxMLgXE*27vD8SHs-i&F#FkX6%=*{T zB%YkJiPL)Lp^Z!nf@a8Fq_|1$eUV9dL_l)?L+N_DV5-Ku4l7ekpiXVsnkk? zXIX9(ABOkrqMxH5CU=AMWsx7{7vp7G7~I{D?q?UZ-ZS}d%_K)O^&;OFsORNb;bm05 zo4sbU5AkMlI_QgZ{NXO&=wBwK!R+!P)dscXvRF+?UGj7!m0DN)f~8vpk($n{m+|~V zrqkx1uWRLAaeM_Xp3kqYZo%bQC3|+%;Ai0Z_OAUfPT$|&yfo?Lh)Z2c@H1C*N zZqc44&Ih&Y0&{jx-4ytW^c?RedAL7TFY>+D=S3rVahs|0?K$6xlWi{3tV=Iss8*e|=b&|dn<)?4Rr%s&$TPxaq51;%i1g)6 zB1z?6TFZ20lA5#gtEc=ZHO`d_*Q3GtMek`^mCAs9DmGg;Q=Xd+>dA|KX3!tYXQ0xi z``r?inis`$nR@9>GK=ap-J{00ElJKy!Ci~$JRG&})7|+4^Uy6MZkCm55^j0&(`jxv zD<`@a6x{1s$nLL3a4&z#cJG&kOL}oye!VO*Y>R2uvP|khOvZUA=A^+*r@NE{{w$SC zbTSPn{N>KCXN5u!%1%64AA_{Tt#4s*9xt*7BdzMo;AW@PnN0vCh({Jijz zuFP6P;i|r9ye3|*Ql0ryo}A7YzR8@{lZjVmNoE-Cx$WzzxLqcnZ!?u~7j&nK z+s-wc8&|2?3mE1z?fU%{+&gb2vf57zH?ODnlNK#3_)_g5GrSp`UfeS?ZYYY^cNfe& z->lxvCQG?-!JJL9e72v=fJU27igo_7nk-Gni6beSl7;N}G}#_kI*s8`htE@s>5$Ez zr?b>tzPrEg@x?}}e(`c$ekmVKYu)DAY&IO#h8OK#J8}J#y#yE2QGS^%ofXFSr}yO1 z>+4hhW(K+H{h(616I*cm9t;Pg#>L|N_2P)RiO-L&YhCJQk?$-k&z%c?3ITmRsgs>V zEuA^7^Y8DwR_9a(TnfawWJ}SKZz)S;)}MR!Sb1m!sZ z$ME;hrS3JAn&mkDAxTa0$+O`pxJ-2AtiHBy~fS9s>;7nh~PqLCUWy7Ubv4|*eNc;7Gep6?zm za^h=$cA6PcAYLDl*{hk@YxR4=-Mr0bPG5w=?d{9uE!^b?AVCn|4a0sJ%zR>3{h0$O>d$=x;rI!MzJxpqnG)v|(N0sNi+@W8G z9YJoN^O;g{DD?(#ljzBP@j(=BQiZuR&fb>jS)o_2z+JL<&K2UBM6-8)MwXYIJF&QY z?k%9&I6u9r-h%nvKj-|!wdHta_tjyE*EYP@m&<2oD-aMrb<)pzm$uf$+BAp;63@1x^ zk~+x|13(B$6g{8`c?v5M(pUfhpLZkL-Mgd@)8HFlb1?c%Sg<#c>s?H75}fO82Dlu# zI>sW7@`b`JmUalFyUT?@9@~URk@Z#V$T-5^WwyB17?8BH`_xqQE`}C8M&fp3UZmhW zvVslj5cr%$kHO-`EZIOF6&#Xz*Jq_7?`~gRCk_cD6A_5oSVSQ1?R`lC$t04238cqqX9L@uV{NIbC*pb%$$vmZ!d~w< ztw&La@vYdB2WMaor4{4)u;CZ6(DWn8bcR8tRcE8?0`-#4Hy2Ctg37klv{ zEr!u8z%57`X-VVA5ykYq{n9S6}XWp<-EQR0gYK7DRcPalu{0FwU1%Z@CJUcf~%(Fc}^b}S?y1Xeid210_Xn4})58yEmuy+}$5E+skUpO3&6bmFZF zEo}g)6U=ujw(O>pz=DhCsidanBdNt&Ba&JosYM4Iz6Z`Xq+5jO+}KNT|<#1XRQ@Ua*-tGzt_E~{Lv&i2zs>1>{O83NgsjbIL|}cP0gb-pXAA# z$#Id?XsHoNjgizCNl5y$ISdCp?OX8nQ`U-j9NgOo0pPn^IY|K=KMaC@+modrtKWq* z5ecKp6A7cANf@<#zeVS(o5%GdTP|5fln{p^S=PvMm$+6P*^XJb!nM0p%ICl9Bfd{=pi9I491!{~X zQKf`N7C0LSl|lo%5%A58-~KZE@wZJA10ME<4}C_pu{h?IE`+D@VON454n^R(p{)s7 zG^|OOv1(%w`dYZoc`n5 zgo7ugL^k0_Ai~cFvk7y`ZJHx|JMjA?=9n%h-fDu5IynN*ZpWEATkmV5lpU{Ykxe~C zBAB(t?vCtC_XRfBI)((+MA4=G?J-)ADPP0$h1u-_;y7bbB4{Xg_|As7T%p6 z$u@?Pk!%ymHcn5J;;X8SK17YAcWv(b0$gNx?wh~`UY_)yA1J|#czxOj(M2#6e zcGBzSc|w6(-HwGbN*s#B(7<-OC~?T~i4un_#XoKaOq4hjB@P*%NFjA99U1nGCA~GI zD0S#JRhOKt{M$?&+O85~$N;j_F~a2%1#M}Aq@u_|uk{wGMtbSU%xu@t$A#gSGc!jC zMsDRIJ2UaM1gG8Gncp|NXg7&PZmQ7bTaCvmsG#H{VB@M{@p|; zN1M|Q{N}q#B6_Rzp^uO_6v;7>923bgPEV9HwEjf0T_oG7B_r7`lI>8RJIET^QNqw0 zr3!t7B%#Rr7|D^ibRBw?y*U-m>;TNvdNcM5JWQo-kiTqK}= zT?-TDppmfjy9rB-&qeZ_ zS~8O7B6)7R$vs<==S(>_yAtPi(@FTW9)HqYZD;Ei+UrQ*peZNhQteYG5LmM)Ui8n@8wRswk@76XnOhzd@k#rf@z80nM zI6hGdkEQs>%|(e)c%l>@;}a>GPNgG*ys@OG?h_^O{HBVKvvq!(2|QcUQVgj#KCLJ& z$vb{q*dTQ$vaCnC&#H7}AGT}gepL~jXvxL1M^kB9CGdBDjN4-AK;D(ynO+`nmGd6D}~_oCc(qf{4; zy&)bHwHb$^_KCK<+mLUhWXAMcEnOkgotdP>*GIL1~>A1_x#!=+v$m&i%|otGi{) zhy)(48ayWg7Rt+D2n4`U5NQY&wTN9J=<|q~LoEafnY=7eE*_DsuK?6~p+xVs1eV!V zWaJ}N2TSzY*91~`6?42YL&a{PG)^2aLxSX%hw5x0WV|P8nrs+4Ybp~9$&lFLPCx>u z4q*ayPnji!w}3(i&18q1Mxl#9v{VNYNs|)U6Ws+!JBm_+Pc_1#VN(n%66An~`YFOV z88-Tc)T8RuK@g>Ze4kKv_8zTi#9uwgOedpUE*NKya4)ehZxgEb$7`wNKsN&ClJd}?3{s^1+ZZb zik@4H$(=@qxHR8;~^5v2JSQ z`dKS030;8I2~;0NM=8M$BEbyRZ>kJOuVg$d#;R4`kf*>tMQ;<>T9hNIq)x?V{6viC z+;_U=I+oQL34IioA_`4XWG(vem}s9DiugO;k?>z|#1lpoF{mcwGeA}KMh^)n?w4-r zg<1nwv+o&2qsao+6BNSqLR)`U0A)H}W&kt^uQJLE-p5#=tXoJWMj|~9P_o%K1;{L! zp;<|T>up#s6t*`cSrP715S@etBl^`}v>>2h3Jjjb4ml0t8Zpc^LTND}n9T~7>mrJ( z;KYc<7$ET4(&90}YH}1T#}gAJOOH0T03_-SnGzb0hdzhP*-Hc_jW86h(_R9iOYd%5 zjaR>DDR11j9G9N;4J(|uz)S$7@yXPyb89f8hXZd-kXDdwO5fhdZg#=K}SF5>9xNU2!07*?rZR{5HGXautCzJXcq z4OI-y#O{>%{RXq$wX)%6Dt6)n%HbvvA6S)*_&~%5J~tmwXgU}lsNJZi9fhvC=^7(ikDCzU`CwLLjD#4<{P6+fGAWu7(vE5hl^u?k)hNMLFF&1 z_2Y@;yuQ_j>slAiK8iwM6rp#k7rZfHgb8jyUP~u6;v2D&mplNq$~nL?);2a;+|Ik~ zh8{YO%L*tdOu?3*KuI#mDjSs+b%5r+L)5(W%(U9wF26dGc2l~Buu^;u$j3>8IRjZa z-2J(gKBsSo5>HTLhNZP|4x)$7&>%%6Kv2&*MCDLMzO6z?YG*4_nry*y#+QobL>#Ci zL1XgeOWkB4HQuUq?rMv0Qn~_ZP!=V#>7Mo*+1>1($N*;SGctf}+YlZRB`zBgWr(Rp zL}}Z82&=TVH+xazmorSer;fjoaoS@L?{A=Px*m7FTN}0EkOgNY&0_s^XP;iSE-#Mc zsdG7ecT^I$P9Tw?!u&+$&5*!}YzTf?&S!Tx8H{FTAJDekRK6Mv=hJ!@!`%D2slKY; zAu=nkYQK+JIdYIXKqRbF%A}h`*6c5A%^tx~zROukQ$J_Z1WFs&DBQmp{^%I>1nv(r zl^bO|q2{8Ti2Y%va*c-*Y9$)ByY(rS)b$SVmY|CCRe_hM>hFTGfxo4?>xaPxU~V3J_yxjw zk1{GOd=|st^D2wa`2TE-*N>v|QKRp67AUu|RZ6|kC}2LbnLe)>$l=I0JrjC+WEzA7 zKN-dN(q1>$J9mhkDrN;lPZKNL(AuOKnntLxua`ir-EJKGL|W~F$O*vLadIYuo%<~| zZ)R3?5jnPIX1(z<;q5EPtVTJ(R_A=5j)VCh)Q$I1a_sJBH$S}A4)p%dS z+!m64LTFU}Joj73;&J%=sgiUI(t8k@{c~{nNFH=-aaXGP2hsT=T|Ls(i4UZ!e^vD> zlCwXooE_PXtPqJ}5+c>d&wD?rPZWXgzu(_40^jfU5KMS6>%wmmjBnEBw-AoMGj;xR zDD06!>eynWklH+vLh965q>x4mX_$FO3TdQ}MhdC#0YnO^d7htAA>GauF<|ME2ZBoHfq#(~7fEn27&=f4?vhqha5rey|`BMZI~G5D}wZwuJzZT`Ok4iRu-p z6OlR*sS`ow9jOzh>XABO0Ys!uMCycbo*z`5uz72{x_cs^WC3m&r4_a~F74ic6dCG~ zl%=sB{R5YFmSL=vi%Js(*fuXPuOxa+i~&hIN$<8(TzhAIWB%I$66=ignba9d;6;8Y zo!mgN3y+OtYaB$+u_VTk2r5oV3W#xa+Y`jN9%7!Aq;UhN_QR-J({)sflN}Goac|^S7%rUoDs2c-7T(>QRvc90*1q zPsiQ}i z6Njq-UQWi+#O8!R4_;#U>zDr9FmZ_Z)H68(SI#T06}h!XIDOgF?`DM4DmOH4VOO(( znS@<6Pb@K1QR%QljlqO83^sj|I7!$P3_-A3)hqw>x<@l2YPMm-9GzBdYp9(x1)i2E zw_#cfT1U%-uNr{6{KJT9Dr#xOv&m+q4zUX+uvZDJ&azzJtkSVW#%{A(ZBjOK&>HSQ zX$!4R$_RozmZwNf3izQ*bEdsbD`KiggDK!>@rE;LL3=;I3!DrZavNw2@IYAo-1iG0 zxD(or25x-E#J~Sg0K*s#>k7u7)}7pKJ0GgvoQSeH}BSdCYi@B+*nCK+#Dh zbr}d1<%sl2(oC;N;?)+*!kG8|L&W567Sj~)Th%b+3&!gL zkVc3ddzHXFoY}g}XsDW@3G+Y#F~OBt1?oIdjisOzAOYICXSqtdYr=%iAqfYw;Tn9r zIqWV#;xX<(FwiW>3c0A7q0{uYyReQu`xY}yliAaWWF7Adh$=hSbPiY*T&gf&(ku2c z`HE`6n1ulvsb_y(^tZmc-Z0~dv5KRj&pPM~g z*0vZ}*>QbvLmG^JSm&n}hGXC7ez`WQOH&RKh;!AI(4$PsDEUlWC7-@g@^LXSm^DT- z6ViGU*DTXMj4ODFb-=HmsJUPj#xO?_f68Wt$Dsh78sWm3xZI z3j5S;V4$l6OA%_<1=VBa-KrOHi;|*&@0B?;e!Db*y_JK{i4O!++3mzGg^CTzyvjUv z!ZrlmtSj^SNY<75B(fFSuBy8dznYwp>HBa;xdl&o9BkuDJ=80?Y8{X6YKP6ZRc+IL z+%|9R{d};I(a05^`kFs#p|L})d z|K9)g!=Q&ic4f0^8|D&fmdJySMitkVI)+V2F5xqqI-E%liiI2xvRlX)A7hVIAU(nz z#20y+@NX-KxA&(?H0SW|gTw#&v9B)wreoLoYBnQ#JnTJ`kIQ#Zn;2 zK0?t|ki?>!sW^0g4Y*B3D`f6L}YzUc8@w(W@$wW0gCgYUR@qSVgz z+LiFQw$1wN8n^gf`>ZY)h1g<|D-#=GTsB!{EzlmDIEHvF9pFg9o1w2NN-*u`-I0Au zf?soswjrJM-C5n}KE>u7l$d<(%NjvM+p_Zb!~{x7bM`9&<2rs;!S~w6zwCzWq>AiZ zce&hiE>W@TsT~POgP5IgmAukj9L1Ko6=+EC4a$@c}*r$+9@<6>Z4`6dDK$AM6BQ zO$d2jZ`0_iW14<(Mtf&e(mA0dJ% zkn}TqlHnKF@tfnRLyqy4zL*1Cc)W`+ufUlnd2jI?ormwK*85cC_X;%qNbwUC zVUPHm7GC>!aGO5-_SoRDsQEbLWzOp;Eh1=)t6Ir75AqXet+%O6qaaL_6brWyS%&r{ zLhntW`aq8G1pht#&;{!j@$x6(Np|SaRl@kKC3P01l(h6ZG-j_{e24pdv%^hhvACO^I07$t$4RlLG{d9 z_^MX&vs3t#4P2SLFB5=&^~A4S;8!)-fnxIJYKe0X8QcRVe4b_b1v=GQF-0s85n?e> zGf`-Q@;9|nwFi&3|NP6qzJ@cJE8sO$W$pdLzkRl&74uY>yaY|3%2H5O=}i=+&Fr*+ zRHTp!Qn-Xpv#U%=R|}B#XuvRB*CWEvf0Cm`qN*DCr?P{op+TtI-59u0%a7>b3%}N@ zRqgk%WxI=9dhsAuY+VHNl7ntE!OM?nXeD+*nd87JdZFpy&>;kV6i4qvHbcx!J^W<% z8IrCjsfF$OM$14kqiW_alwH=?`J;l@ zCZKd}av@?#Z6g6x7WFp~!$PhCAwq=^+H5Tw{YMGM2*$gDvd)jk(smYFx*{M8x%fxY zKx?7afm{O}Q-C)VMN{{01=Je}umZ}nn;@kP7($o`!;P6jFt*^#3x2xXJ!E`*Ww7{S zpUzmbyEtf-cNqHgGF;g-5=%Qg288L)YKx-oB0fln~8bh_C|AC|^KMnxNVm#qO#oom3+5dN;X zbEvAEA^GQD3Z*y@JJgmFnnmUBz{4}@sPy3G)iS)N1V__BUdyvYFWjTW__s zP^+#y{?}f40$_mhY?aS%!s&O#>o?-|Yy93GF%)SiB(JyO_Ab4I=ky!$`k>rC@a_;$ zq;MqBz^o!n6q!vkn_#~0NHd$dG$*2?d(}&`kn6vBn|UlWN{{eIZbO8$mBqJ!e4$$K ztAvI??GRi=xr8y?g2U=}F?4fWjD%Z*D8?lI8Q{hHlb0ogM+f^=z@fVcP#8G;hWsyT zkI3_4Q`=9Zn)L}aZ@=++Hgy9>@Y%HC%TO zhkwTv4je~(Lj2t|iBMUlxMt8yQ}hJh()`EE*;F=1&^cuHJqlosh0Wf8s=^dXB%mipF^XJ&L~1ppzTK07;l6!_R0r$ zZ3PP*n35xg8{w#PmYFb8;6seuv%1aCZ+3W*ugDi)TAj}zm`y~H5aCK;wz&7)-2BIp z1m4iXZ)NYeiETgrX0>IFK!BjN_uH#{4{;^~!RfL?$4W|?8=9FR$?e-(u8JZi`<6$2 zZgGA%lxLaW;CQv*CRTgHs;k{dk1-BnZuMtm{T&ZmvrRYoILE4KL>cTdtH0E1(`~4` zDS#pKf-*eZG*WLCu&XnW{AYZk)pL!u50F3fc8Q(7&UX4;jy!V7fZIyG?v`?g?X&Sd z4$iz|GO#6MeobQwy?R)sGqmm}jaao+Z+8s-GMHJ&Ed@o%-Sz;qru_^TOTX(7K;FYDA|_3eRc71Z>~R>D#NMA3Aw_i>l_< z63J!%dE{@XLaNk(i9@t+fBRh1T}TWk7HnaB+mj2{B}`S<`jC?44y1&LbFG*Etenf+ z4E9kum&Y*(JLN}ySb!_H32G_uO`C2}Bwh=>vJ}|bm7LBv!>MC$0b^%HeoLHvJKN01 z;r(xlT|Q%!*05}A0==qP>;M&eQyTFv?Fg*xA)Ln{XdefY-qF@Tv2gj}N>l#qUARus zRHwkvZ9t0Z>3)I?h$b&G5;F%xjOfVXl%W`27728s!JLu&WXW54P@3<87la#o=rqf? za(o!R^Floc8OkznyObD;)sH#Z{LJGW9LpxI4vA%X(es4Zk1TL~lyk-csE7J7Vf4`l`c_BE+X*8aFGXj}6U0srbJWgRG#}~c*h32U&<6y?%dB$t{E$%& zR3&T=Ow&(!{YLEjY~AD{cR7vL`&dV%y?x*3Iz|WKa0kHE1{zzVh+81{~AK{I~A9ZEu1A0hJ>TCuo*$yiyp zx41Lo4cSCc4)yW)!fvk7C<_Ab^ZZAHSY$6IAn62yZ)4Op-S1H$ndov4m!hr_bk3H} zPk7IVZ4sx#|IJ&J%W?(3hHM)_S-ZU_!=Di0>%I&h+is8z_f5Cja5hrk8>^2kb);gU zf`m@%`Tw`~rQL}m*@EBeSLo3_$Ii4tEMBu;_bZICjaO_IFIjnfgd{+=kYp`jTvO-F zZ<(Jqzhq)j2uXyb5MZ0kf>ZBx8X|6N_ujaBq(ba;Z?!~X{oGGmB;BHk>7C19lKlnV zf|$`fz^wPL{Yo!1JQh}OG?1}U$;8Rjyck~*(>#7@Z_+9zWxD;(8k3TW6gaIJL3xeg(Xlcy*UBJS1gC!U^1)3Xe%b;fu~~3hvnq@cTa`Gr^30Xl61k6 z#o@PEW@BWLTe=_w8z_>bGNovy$FF2uULjlvOa#K=Q~H_lO_m56d<3dZWAzHtLSRCe zCQB}^{ggyLt?)#l-lJmlQFu?D4;c%CW+( z$j{8LJTH;bkQz>9DEOBesXe`kdp3s`ZN z<5o9b<1MG-6%e&}umJxT>tAyIKWow^x5gW$K2#v(^1*#jbzI*ALGeu%a%9U8L^(@Z zWED*XGlvzF*Z6^;2|ZZ?EX(49snD!jR5x`)Hf@G`5#l(6&R8DBjhF&NV$Af-vEGBz#jH{-BE`e`AAISOR@LhB)TOT021-<>( zLpal-LJrIou%a#eDR?Vwdtyv$+9pBNx|?&81sJ0Wmc4EnsuC#AN3wEiQW1d#*g_+-j1kZD z;H?U{luP+h@M%N_$=0TJeI$J=q(u~nX9Y!_X2^1BZHAMBpv})cr>GGysYVG5Wc&ts z6^}|R)$Ac4O186yhp_@?>a0nuG zc>tx5=2#a@TZ`HQaD6|+Mt$2htZzI&8jW%ygqaid0Wb103EYvZJr`4B+N~3Kbzzt&0=`338AK603q3xyPiV^`&Uapx$Lb{ExZD7zv;d z=?|ve3ezfM0vGoE^}|2YjK@U7`wtMr#zn>tU|lw@b#u;TxeyJ7RvoT^-|Q>aB>zxQ zRefaPGH;63VD=?+Rzjfg-z2?llat+OQurjo;tUwbmBY1`ySP$4Kcmxov zx4{&&0R0pgL@VR5Q9n*ZB@Vz3(=*=6ab-#JW=uc>1c{!ZrNc3LvTb=K38&z0gYCuk zf3yNg0_z4qJ>h^OTAO!hLE`=qLI)t2nDUFGSb*C_p+xxp!h$I$PNYs*mJsp-WCXlb z)yH5~hN-~wzzfFTqG=Mw9`d^z5bB?e{GpJDE2=_!;Y4cP%@*^`eEu8y?;*@YWH+>dhA=HtjUUn$ zden|L@<5gptU1TytZvzd9zxMTef=r``a`mh^5)?K#FwvMrxD>w69X6ukP{r2p#m{{ zlN;*}H&Rp;p#);^9$5GujSn^j#USyh3Sc`BD=9QO>FgmsoueWkV0Ub;T(9}MQCTH! z?Jb|moEl0GW}na*4C>zyhLo;5kPZ!i_nZYU5yW$KNHhLT2HG*$8Nr$&u64-8$p%8o zf%_6}6kOpZYU5b431v&f5DdYx0KG{8Ds|N}=?mo;zJBdMw&^1)boY~Epy5OTF^9>K z5u*{9fS`_{g-7K~2MAQYdzcU|#uK*+1H5Its>f4&gH}!o)j||O z3p7|;rZmpLN1@n)6}FHWHr=Jis>4%u`9V#Bq6&KNA0v-sg%uc(dR3m@n*OEa4}z4H+Z%Wa-*J0-TvpVFb$y5ke_!dWdtgc|7BiZYc(v z+7%qtZWB{6eOIS%OYdz3df;cYk%4xUaB@WBMYbCb8gC{V36?Xk&Nme=6l;8*vH%7R z_AEORVE}sPElHSnsy#^KI#}?*MvlyEy9z8O5ZV{Q^cc@+(4`b`MP@@x&QC8CFBlyg zsKX%b)6*|K#W?MNVRQ`t{upi$@WlCloHkkd{CL^IPwYL;JWemfH<16w_)RGO?9RuS zeJRH63&k0ei98>_*KF;3czteTF!wd>M=V%RVv3M5qPtE6n`!s=AXd7$^-DKYWTZKA zgG`8wHmyc6_&P&A`D9OKVJDjh{}p09m~#Y>1clGog$e+K{B?h0N)O1D^RJ9|B&yS7?W1BO-{|S@1D(<%}Q(ceE>sYpk`Z*p& znk|ani;X8ookf-;s(&MH9Ck!ZDvutn*iox5BK;1gVAKJ7lOHe6A9YO~13J{kkI;<; z1tS|4hWbU4@?5fsEx10pe$bz$46j>>?0jrh%D)L=%#dC}!Vh@GSj>Y2Q>7XfLJL&- z`gqL$s23S^xWd)@iyZgy4=8;1I$b$7I3oGmu<(O}BC??V+tHpieWd-1lVnkWLgBwP z-Oi$@FH@HO#kpJ=9xM7qu%W-ohCi9;DP8bwRxz?zI{z06LvY2*32Z}G6>&_yMj|Ji zTGJOj$Vm!*;h`@KVIaqtBXo?tWB_||t0x!THO{>U%m3u!qzL&!-$_fwrQ*1;3-6bB zByCa)y&`C$tR_E4mN0tA#nw<@4BbfPBwbtcQ8?J^O&BZf#)t{QpiK+sG3RC!D$?JC zOaJ!Sw8(%;n8W}5@e@9G7TG3*J~ixhC##>tS^E*mjqg@0UpzX%IGYem&~cy6{J{RA z_Pq6PQaye3d1}(NBb(6`2bt8PuBi{uP5EAB`!gdLtBr=hj|i;8K1gOm?z0~O`)o|Y zVPu7`=zW?>IFUJA6l3y2m0K1AM-PM9=|G&a9aH1b$^f>aAX=EafrEqq2<(-GcrL#R zFajBU8#8qntGw2%HkxZFGIo;Mz_}ai#?kxwNVvmeaScylGQE!M&M=ZCN0JX~g^cLj z`FY=ROHy9gA9lIWC8Y~_aO8Rf%hE*!D)Nu;=ukt;0Ma$+COy^;S@{0X{JzuQ=xMrG z&Fc3*mF~K3uDcqP<bx?MRlumDq zKG-dEu!!I4Fb5B25kTQ!1UX+I3y3H(-|$J2V@-e@C}N}-faO4uQMLlL*TCK|f+Nj- zp$7eK#zbj%mkYu>Huzb*xn}<#R>fJ%$m(;H!a)Z@}byA_jnGI zoWbRf@3C4vQOxzAvI&Y_b7pPTFE~a@Z+P|`nf+R_Y7~$b0ry)EON?+mP-0v=0Z0a8 z|H2JW9Shh3iEry`Q-_ZZ&gBgIlNFs%W1wHjP~g)a zadkk7#DcJlw%xI9 z+t{&f+fF*RC(pa)o0)HBs@5v)+V_w8Rdw9QbzTz%sQBc16KsPhM3_~(tVs*-LQu-E z6^FSI8uN*;n5yfXgFe_{CkeD=O6_qWxpi3e)FSnXRIq1#3M{YnEz*OMFMp4l|E(rQ zWR!+x_iJK|yW|(;>3>KS7=0M7w+-pAIL%FEVNO-4%RPMFNf7OYE#IpjGJ9waa2l`l^vWfgHDTmJ|J^(Uvy+ zhhG$oev)DP-RM~J5@w)yKz^hHy}#UXSEv%P7PvZX2v4!{H?e8&!5;z;g z=-=Bhl*Lk%Q|09%T(plM5Mnur5 zeH&xGs>1VZJuT?+IO>WVGnX&41UD$%MhfPa3fn1M|DFg)=~5ieJwd``>)w|ZJg42) z+DuMKpGfUi_444&cZkk}x>3PZt8o=!PaShiJ|oUCLO8JCemoK9rbrlQ`hwz}evrvJ z6xK=HGa62uoUgz@%!2P|ZJDS8I{C1W;VzpoD7$DbCgg3Jk2Ks#KZk%_p%{tXLtX080opraO7muG$C+r8RJHH3SIm) zFZJJ(S$GLyEAbRq)M)ZK(=#v+I*l?$7%#WAhQ?%Dzcn5|l%afWo4tQg^j5_&CIAmN?BHb_&52@I57n-C7*wfCv@fO-qDQO=1&2TO zVaLftk|ySNX=k}i=03-GGE8+c5!GVsS1uGWJbwWv^$L;b*zBBVq`x8f=j3RS+WW6!vYA=V}!E@-u)yG#)ee+Nc zZ!O9bacTu_g*CMDMwRtz_#g7$zH)G8yj%}!-;{ox{i7e2jluN+F>qF1?{0h}_~%#+HbKRE zsaBo-#_LJ%rt6N=;U*mBpoHyCPmDz(aGbeG{5@;fVpMP zfwW1`E1G72;G3V-S&KRs`qkdMOC@hGKK>m`y-`T&IL5XP_3b=K#|lYV<~Q;H{js4{OVh4A4YE z!ru7Rf03VjH&WO*TJh2~mi$C|^8*lp_`nb&>>6gb&9MWi%%mc#3d#+RM=d50!Q@WI zey=Ig@te1rZ56bi%*Zw94dekqW!DduNhJS2k>D^`@Wa!>sC^V-uc2kau~8f+!GqTy z=C#N_I^KBB(B7bLf(pub-H|aS7ofqdd96G6=nM$EM=kBh7WyQ7ipYIbY}?WsIcbAo zqAk!ZiOi7!|9@DpD>qPU!M}g5m45qxKIJ;C7X?hJE`%Cx94d6*Gn)9+s9R(581_bB zASo<@H{(iZGa78^L;DaOL7(lJSV9B?AN2;(F2yPnOzEO#g&mej9G%WAA57!#U3KFLvDgi2E> z1cPAl6;aO~%|pEY|3JYB{Avm%i(rcPURdgcSV+oIh*?KCP$+k6r1A++st{qDi$Du2 zB`=_wYqQldyN%Gt=o5)TCHY_`rvm<6F}-C1^k_HAfuMyreJ7s^)vOjMsnA&CaY2~q z&Use2f5`lW!Fq~!U=|`I z{x>F=E3{{Bzbr|-Yw5zk^XTquKW8`v?$X5B>g}2K5gO48y%@-u2_T8tjdcUf;-P&q zVM6X;T;&WeXD%P)|63FAhE&yb01idHEGm$}K>_8tVWR>jzYi8k{uL(n-e4`J>OlUg z<1S-(>N}7EpOKT(77~fhDM#QSDg#xeJ*d0|7XtEV%v6S(2Z322g$MX!AX+`-VysH& zU`wa({>xz0JLaCYNSXt!XY~C56Bt|=TPKGotKbENO&K{v z1xP0f$~SMaE$*k}{7R(CAHbQw6(wbGx66~KDB@M}{=1#L5(u=f#(9f?4J@0W01FR9 z%&<5BFb0hx2%XvJ{PH~q9bXDw0zrGk$>9psb;}?H#0hszk}$@`0>(8FixdOA&SGeQ z+pB5m&b-;n^k`I`hDu3NODBVoB`$Fc^hf=XIW5_c#(s`li{lGJPWu`{$q|(WYIPU{ zGnF#miHaB`yPf(Oh~f}{TbKUB0(BaJiVfL9IDx~&#C|~)jZKp2f*E-!l;pE=wyv{T zfqVi>zo?6vsc>C+fhS-YqaC_sg`0nB#CEfKjO^R|g}iTYpFk&hWx&qfp+54+>N+q0 z+4Vx;6zjHv8>IUpj_e*oaFZ77bD(oCj?>|A{{8~pX8mD-WSXmA3HD#@CWM}0A|n2^ z`rv5eP{CM7QybcVXZ;>|yL0rzl6$W_b}(a{ZUt^HNl`v0IMEcKpQg3!`W)Q#`ODjPr5o0U{D_KnZ>=`-J;ZR-x^6`B zxIkgO^gsY!BNXmIfo}>>cFccp0Q>&%c7$|q{7Deru4I#HB-hm}X7o&9CR3!X@Os9A z_<{T&>a#7_ousa!Y^Us?kWXQv?G-oD3MeVk5m+280j6f;U*}*5us>e=(k+N8>Qou- zJJ$ZUK|-U6=0bMUpuL}5Yth=E?z3VyE&V!`%;smB+n3_@ zGS$$Uv1p_{OEEvcadA*Rgg`2S476(~M(Un1G$GNQDTtQ+KLI5sdxH>rHVA578CdX0 znq~-YC}rv7HhYNJKMsLkZE2$B&IAkPJVPbC{%uKjWFB7Y&RXNgt>z^Qf5(yiY^O3;5O5KNx@QYDte_3$;NCdQ)l*`oKWzvn2McYS2u!*! z%Xbr!>iebdOD5jaUcL_LVZR6t{MXceRYzdqy3Ic7-;E86zG*MR#2gr08|6ZL+ANagFcXAy8ZPt7tkYf% z95;HdJzDDJ6&8~lgtyZ9Yni4q=X&h~rfU_ixMAg%-Joc^^feV+4Ot>k-r#HI01zQW z%ijAOcxGOKCB>|6Y*7Sq#eO8!UK+cz+|RB5{KdK5MT)N08{^M?EuT@sTi%55v|9T;!fuS z;idU{@3AeqZ*!%Iu-<@gj7>Nr@`@XosFc(KqW454BWhDL=hTZE-@dNQmAR4PN z^=ZXh_>qol{%V#D~F6RIw}Y@JBo!+wnNu~H_Lr^v&5nLBBPg>Q<@S47nQ#H2cb!{Y(979!HdKH z@a8yHW7wY#g2S}Whv|>_xI}g8FcUA(;wd21i-jPYEj_v;Fl?Gk69aQq38Y*?eAMGP zW8ZI7HLV)JPK&GyU(2cG;s-#1#*Is&xoqv6$%8$2RLLwJJM}yx8aE6dInnZ_`dmxA z#!7X?k@{RKW)q-2dtS86t1vDe1<;~urXy~W!1Tn+VXTNEKX8ZItOz8p4kQ-`a)a%1 zOo64+IWwQh;Gfr!R(k@zGOa)1f&F7_GVzsVlpN-1EF>*yO=Uh2sUlHKO)4^fQL>pV zSF^le04yZ|3KvE&PEatfsFDW$=Z;>*tpV=O938GgA6{G?Gs1fbI?7&5V3Z+eu69Sl z>{A7d$z&}w?e`%~QaNLkYJ9J1yx_~L$%J8b1XxW3n5Uqc7>K$UNZbGX(u)o0Way(+ zUGj4iPTJ2U4W>$x0G0nX!2kQE5feHXL)n^V3BL2MnzbgJxlYnn1~`)f;u8ML&&LOB z+Jh|iakNGbF=Mgnw%0cAyF1;+)xmLmsQYl3CMx|Wp&gB9*fX3it8bMm{~;!e3Dz-j zyj*Pa>bD$T18XOjX zo7rmd8d!|5%n~zn(#XR8K;K`8u0^F&ZXHsB*8Z4U`dGs3#*@h06zrrL+x&mx3N`o? z&U_RI4}GLl{w6#VB_mpzGO7fApkL5GZ@)-S@TBbs$xJjR3|TB=&Y~2n4Fh4dxXu2q zAAYdQCs*Jgd-;WSdP6XlRb*ww?+NMEHP$z807#2LszNi_E3NsHBcNTiazBt2#+O7n zY2-QiQ8TVJb5%R=ZslX6<*yNhiSn^SIHslT>nii_J+f6Ue7fZ&lhuK-LH1_D2zg?};pz;ljs6obUPR~DBH3QLg1{~uwL$SjG} zx1pcklElhs5`hEN*8x{mCah~}XPaffQoRl=;nNk(c3z2IXcZ-M3YLoryeC;;quq%n zs28e9hSpZd-$H+6sp?v}J>q`S)}!^emy8vx93MW5q@ zl|GiiM6Lg=Ci|2aS}>*UFoaI|m8#`b#sGYz{5t1IYQQ!!!)fe?2U*88KMD&fIE?qf1A5OEa(2jy`y|0>w1H+kA%gfBz0 zP(~-+pB9`LLe*rQ5T|f+dOuu0+#0GID=S!`e^MUnD7e{`Xw^Jen+K^SQ5peUt-a~; zhdN2K>A(MF3Ejv#5l;~@6?I+n0zd5f49&EG&ti+svaMJ|OgO8#^0SI45I@mj`cBa# zm0)gS5T#AiW|UyapJ*S^sRR?bM`j7}%2DQ(pegO>O6u07wG#=s@OQqOaN;TR46{#? z02*ZX8iTdPNBAr=|8<5DLLkR%{f*7|=I@!yfu7mV{z- zFF)FaR)HtoR%*_kXy|Z3d`9Z5(L(vqv+%iuk)!QlcNT&WFZy;{Y63-E%VM?U_rtp# ztfFQ?BZOr;7xbfUIvv!R*WII?uKVsr%y&jbKCyMGeoTzzkAEfs@f%XCn%x>#Zu{jv znsNK%Sr9loCVK-#n%+5@xLNct8XvlD)|}gK>&(-)NrZEDaq>DZal%wx*wPmC0{-`_6V_7JL22eY@Tdx&YL7eF7tX&q`0gS-_*h1Y^P% zc+QPrp8Se`&;2)kxu`r`%{g*|4*3q^AS{O9oJP7Wg>L`lW59mbwy?Zb^Sbz-sj`^u zLSe3ki`!&Qjuqjd>^}8L-9j3o(g0)zR5+)R6_DOv$_%5`b(xkZ071VD2HRIhHr+eB z9n0Qlzt{6zXbA5YW}Wv*l856ZKF|j3<*vYnQG*Ur8!p^f-{MNC*Xv#O)R5 zq%WfwRW_`FAw09qi2DBmG6d%EdpzPHZW-RI&yf774k%>6fFMTjfa(^xhsK=+@oCeJ z_G{dPAX{2N`n>Jd&KktD~ZN02|<3P$Z=w1{V8^o%k zOq_u#w1T8{n6psMGRYCgPnzC_(LgV53=Mk&e^kQ4>o-Hc2QX%4(wGw~$VRLI@ff;F zl$I(kv#}Iq{_2u{c!{~V(1_TCIb%_J(6UJ4=OL{ic*Q@dT%tg%vbZ+LS$;ykzQ6Vx z$~rN(Ri?L8s91sr*Pf;F4Q%;4kkU}oif9c zLz;8>Y7>w5t66YG@l1C9odY&t{oNE>^5?o}EmD6nVfEB@5?TgKV{*39KKWTLP{|=pQu3br469Xdy9bha#&JhFXxtfxHr4}o8eA?q!B+b*Q9U6zx^yS|8WSt&&Qt) z4!S6jO z(|Uj;)?E+H1n@Esv%m`mmyoor9P!ASfaIER2Y-CbKu%#NJ=;o2+lTb{X3QsSwaC9s zV06*$1gTdS4M-fl?tCY)E2SPT%fX+Lgw_Dt7-v7mA=WaCH&2YHRk{M64kq+@DIm9t zkwr-`e1e~M^Yo3j)*DT=84N-r6EUe8t{Lems<1GsKWE14JpYCiq^25@k7{2}2KT3n z!5UG*Dut-QL2>9Z=M|d?3W!*`(Ijs7|Hi~5J)%RTHF)GHt|{S*^|Kf+ZQ^`QU4_^# ztoaRVGU#E^7%9>b+_`zwSE9h?|Cgp0$bQwx(Zjx0fqb^KN{WMO4cRN2={RJQv_{)F z8V|UJtQUzY>tCKn*oQuBTvYk$0UNAi2U8ccjfV>wO@%G_GNaD1jJqZav2q$sr|9Sr zjsBiU9oY5*YEtTo13|}#54fD-NXn=AcpMtGFx0oH$>A9~*rx7%!!+d*DEG0Sni!~W zdjT-mdyp6?+txHp3q2y-hB{|&XcSST6a#GL?ml@rEoARF5CH)-0E-ABBm(4xVqe_$ zupb$BQ?gF66?pl$c(cO0r(?M7*?@ZdnenDVyB|lQNBM|D7UXEmkkYnGo7UV_&LF_; zaq=;a!X;wjYM>_e#zZ|$az7NJ&iva+RZK5Ncr>w%yy8}NDXuHhh`%Z4eNERc;3d0Y zX#b!J08yy8i)ttcntHhM+{c9Bt(UJ2HA$xch$p8OgaY}^R4GNnu=Ed9Dc<@lkgfOZEfAb7m)ZN;BgALH;FLl^Ki)!3rAaY~y~AOV5p7rnpoemm{wCGWHOH|F zud{c_mKKtB9`yV$vhj#%wDhf^qmLKCDnQxR|A~~wxoIZmkzMX0?5px{z`k=o5jaI> z*GDH05|h%Pu7L-_YSylzaihU)?L`RoCm~xMfB_=X*PJUJhWJ)=-0d7BwUtY&4e=q} z>R4KPG1ttVb`#Q9Jb3I%vYijQ$$5W5i1YD=$o4GI%i(7{&i_73m@YRD6c`5IeZaVT zGBYMHAeeDi=>z2Smk%mYt+d>BC zE7v~8;XF_sI&O*SM{=D?NtbWwCs7RebZT4E;DTJ^dw@<=5vzOYYlnoTuQ{wL2=KShYZ2*-o)Y?PdXTCNr}jx` z1TV~@#CLrTL^%|pc{+_?1!JV%Z!z`kfaN$F7z5-_(-16Quvzn6Ycs+Dr0YkiX z_qh|+Eh|T0-O+@7IIMQ2P06G+IVb)sl-)F{_DkG}-bGXdzpsMt2U5ppi3sE8+fA^M zbPaLziX5@S+3qD%d88a*GGK ze~Cv2l2Qj2P-P@?-e((f?(Y!u zF@PeuJigO~R&u5KPo-pzkO?xuJ^uU zT3UA$gYLFW4k+|#GnZ2UK^dFoE7ko%Z8{!4IPlL`wc0lm%Ju7hND@F%5IFc*#}o5U zyG3BYv?tNaQ$p_mKfs1BKYA?8<-t|WW-^4_yJj*ZPsl>5cln=1t=5Cv^x3nmD7epu z3jL~Gk3J ziBF3{r{=lx8+;G_#N$U|NJU>(Wz6N~kp1a*#C)J;WE2}RHy1feVbZQx=?0If10gbTQyJU9HOKG*Cc=45)S5S{Ify>y3cbiM;)VEgMxkHX= z1?lR6YNJ}#xQverKEHQwKB~>Ak!IFHlI$zYs}7!{phlj$GD|;&8eBCWGq?BZa=vQ< zglUPD=<}Slu4;ar`&Mn;VlP_0rRWRSu+)pUOSzS#$x>-u{)?Um8pl!_0^Nt1_2uES zAtmK?i|sA!S_SR%?!qm!3raPs5$sm+#fwPj{JZHX`oE<=&^-t;I#r2d{aq z>a^!O&x(RVZHm%TDYFy9Uk0H&Bb#8#STJ-nr`hxiaWiF ztGop6!Mm#j{~7Gb@>Zqmoz|rujy5hPq`a#2l^vUWZS-6(4liFy~?!lFKt>-Xi#h=GnJo7Lw$dBTu-#pw$`ttIGG_926g><}bM;}-2 z)_4atAN%Un7-2%6Pw95IZ|F5%IFg);C9gAHv9PTz2{s*|W}#mmx8|b}RDisItjaHSgh7 z>(=PxL9*s{f*ICoV^K#geNN!#@-pAUdIveYeXs50-pa?hGecYJb$%7yoZI8v-hXfM z{kXQuAfV%tohowT-qGXaI&X8B+Y;v81>gQ}OHKRk@7vQN2taM2g**9tZNj$rW8S?i zmtCLW3a?UgA%>uZv3+LgIN#S!pg9*7(z|Wp+_g%+*=-(s8$(W_y&O+B$AYqXPu{Ep zu+-vpsXoHJ;rCmg{grB`gW<7Q>+#%Mr(uWCC;%b$#R4c!|cF9ev zz}3ZuuT>9W(dU5E&!H*{d-_T5`)aQ$Uvhogqt%Z%<Q{WF{H) z!dnAB_8LN%(7x|vqw76e{=%`a)`ndnV@bKtSC7Y>qv$|bEP>!k`rxuLGjtJ6TO0AR zAnyvVJWPyq$6~ER;`zDjE2oY!J00`fq#NL;R4cHV(_?$tiBk)?!dRVc+4bH&$5-Cn z&ChFNw_|HZ`_l$P)xvpO?|HoX_n-G&QTG;YGklM0Y}p>#L$_g1o7y|af=+_XX53QM zF4sjri?olUjaRGBI_H60jBSRTD_G(Cmlo#jl((tvRrfP1b;tS*+r^z6E46!ZE4&=I z3eVdTCmQEgd9t)TJs!Fy*usT@#ugvHn$#AK8X9m1E0G!u;Mlee%(s3UO>6F;>f7iw zyG$O-*T?R5QrM06mZ~%yL?*jhN9QIlOKU=bhnaS7hY6(^y{V5YvFrAAfp%o8-Li?# z%K6Cou1z0bE}yQ8?Hs-A>+KfChZI+zUm&7nmwdXhGY@ykh0Zw3TV-0Uv0uEiWJLjh;%x!^>qMj}0zV@XII9 z@2`Sle9ZCp-8UJ2^+woA*zMYuwjY(|hPZ`YkIP{e4^3~CX(6SZ z%Cj`3f_F!!i;FrsLc5>=?J{G=<9M-)Nekp-J|Aa~mGe-iiT*Wu=ybK7O;XL!#ys?n zyQSpgr>h)f)a}ik4nYPk;@iaBr>2d;vS;=5<=K}@arXv;derCkXR}eX^O3uvC$}}1 zmv+PIP8V(&CAnE`qx#j7LXDd|#EkUFY3{?zfzKELt(q^7--a84w8C?0gbEwSL-d}u z#b!I!mX7mI4x{ak*7NXDvbDym>uZT?mfhl$U2x&Lhc2Hj)JjMH>EYe}(dGE4Rfpr{ zIDwReOXK@y4_d7_uBXMtPY`hh>q466R1-#rS#;mVx2eaqXhk`RSJ$-$cuvE!hhNx(1KWGw~1n&a4YN(shKzFxv7j);$G`;$BG zQun1qvT7#4y816I`df^fnxF&2y-hsHk!Z?tHP4i+llmrYN0n0FKhUWhQ*Rq_e#j9k zjHEuZ+cb#J*{GjQ<^tNAnl`0AJ`5VTk71QxFCNb|j}<%T&y<*V zh8+xDx6Rd0rzMJ1n}MJJOWKXG{@QSNpFIdkSmo z=A4+E%w^kp`+}}=N}kubJlA3ln)xr{o%60_SM832(t!wmUc4w7vyHHgkG;AZYXQD& z^VCjzu66;7)<}-w7$r&fT@%Uhl5-^@}-JPt(2TpE<0W31w47Udz{u!!iH~(9f>=$Rv|C1 zt}a}??6h&RxKmp>QkKhm@E3Plynb4J>AiXz^eq3PdAe;2AAAz8^l@=&(QT_;`oh0x z$yEzY=L4Z4jXR%y{`VN59#EL5nip%w!v967#QRP3I`|J5R^xGePnIrY{?}ZdROaG@ z0<(B^=~)RL7HQ|8pO%q60Tk*?A4d-526^CRgJZ<>!LO8O5sa?{ue*10|IjE@9_Aw9 z8mKTi8umD56D4M}7MNq~A5$TtYM<<+|EqQS>naAYM134N|CK^_>GpKwEs;{xWt88T zxwH1Rbu}PC>eNDn5P6@>RQJXWAa=k<3KtuE#NUDKDe_^KDz*(o=hfCx|Ib@V!|N3R zB}#+aN%pVRaW#J7ZZSM(YS2w_tj|}iSLI~edOFu{l0^?G|0<_R(MA5BdXwFWN5F4g zhet&$ls^kagAL>Z1>OhFQgw~0UbnwBIx6_jPk&uE06%cZN~p0xUeaD0G8V~4y4@yz zmmWEH3dR65+9xAPGo|k?7O0Z23Vrl2WVX7xWq5eJify}R z$LvP%&V>W7DEdB;@(CWVNPDR*^WH!L?*iEeQYcC6x)pg_Dl9E%E2h*HY|f~Bg&r47 z4?wEKa4~i296}wVVGWpG(1`#r?o5I+LCaTmz}Pet@bp(0noI*8u@R4F2a}qK{%Td0 zLltUO=b$tbB_@=8A9HOBN|=4wYMn+ywERixWQ+HjirA}A<3-*)pZF&D>0`snSz zTk(`BFV;R3NN-rNk6)}oJWroIr_hUDN;Og!R(fT!S87)`zB;Ri-dVM9Bcy$7sGg#T zPClR%%qU&WDrJ3WoUG2m5z31HChz^?9LNHlE%y58@hx74ifnT)2f>f6wAM0CkE zZ+k)&{0#~uv>jvO>n1p%q{bpKwK)|grx%(N904S@d`cOA6V1Ne#o%Pwma;2wb24Q9 zL5Cj&@uqA5e>J(OdAIG3lS z_qSF+kH|fuf^9#47b$?ncp)0I$^rvUx6$41f_|qwfEPe+Bn?49Hk5I!TTINPs9w1P6el!q9CD$ArgB|EsT~*#Wbl1Wp+^+f|CgG` zAqMSZ{1IBi9d8-s)?%2VZL>;|w-Bynh~1A-+A`uO0b0NvEpC2Ci$+6oy}t{#2BZ~Z zcxsx2ff^{OOCU&X{8kBDQZ04~ylZ=dZ_C(b&W3X&3dKr!4yt!(a;Y@u?#9APa}$5D z0h(-soB*d!n!?VkMK=MI0$-+xOyY7Rsgy$mDGf}G8>%XlTJJU|e$hFXB$O=S4}<+1_rHmWv3%q9%TyTHW+NOSW^2)G$L%HjyR$>^zEE>&<{bSqnmLOZ zCwL&Rc?jrz;35@}_OmM)pnlRAl=dTm^!I|kkUOzp%0V^r$Z@kuwpFQ@H5!{kToq1} z)f@(0hmlS(CoxuGb*n5dsYZMVixMyIm_S%7_$>h7UMQ8HSsD;r!CtNuBytmZ{~!ez zL6H$gGXOOfm)mez8}2qju!y;AWAAr2rvWKh4Jqi5CI#$N2nTqJ?P`M%EoXdNhz#0~ z<0yBM+P4&8Kg<&M=O6z|BoXRLVqe3ipbHbIMl+5Mp`u@yt*I(u+fq{XjdgF_YnEMY zkAt)u3sFD#wp+w5C3J=4o$*foUl})p3>xZK_;nk{K(JC~;G+~hO0)C>1Q%y8rgFx} zoVf4Qjy5P6otaA6Onc%HeBc0Va;X)1TQVmjeTXs`Q-p3@Cy=U*>V5-%X0tIG>3AVM z_thYZ7g94V z4&b7tFk1=Hxqn{w`a9Id6Ky2Ru`Z5gY5i0ypzr(6KboKJcElB;aY665fJ_`-_#B48 z3vb&zJwbiSx9X(VB>2ZhN4p1!C*YC-r%uL2lTCu4m{G%fccQ9C3wqK%+n42+GDs4_ zMEtXh{o!dEFjkZX1kxE0|IoiDHb6DrNs42j23QOnX!scU(bomfk$P&lZ-m^_Mt;N9 zd3E^Z*Bkma>sK{2tWA^8*V7{{Jdb8O!w3R_E}@?3=gbyFi{tr2(7SIKS3XO_)EHZm42YVC z<#4KkKZUqQc{e(+4d@GFu5}w;Zz|KjNC_9VYJ-)`Vbn1A3QYMb-weUFSB@QxC~TIF z$a(hyXOkBPuLYJ?6h$&IU8;Q)+dhn{l?>2txxTn>tztIVLlPiO^q&_RfpZf<)bj^2 zn_Vd0qS@b#Zac-Di7~QOhcEp)VeU2icMf7w`F() zo_Ir2Wb^?VG5=$Q7DyTL?0w{;#2mb2z^Fw>yza~Y>Pe;l$9Df}ciIzH7fjKCo@fE3 z%(^ep6hhFv6U`e(E|ynOxhsK(eX2J!nu8g;@}E*FDS>-^p$Anf&6^d#DRuy+ zu6Xxo$ehIX7?3~S(g_`e84z4p0c8{Sau5&#zUW=aqy#)mUFOp^MS`LKGE> zpREeGGOvW-{@goMqA1G+_01AHr?8oFQNBW{lf-;z(vh?fy(GgmkVErRzx)n-$&n|6 zw%uYB@kyupzPW0&>Fw1q+ys|(9lKLmTvQ8m-@aVlYg;@cfgW1DU?tBFOESk;0MD>N z;-xq8JeAcQW!&dd)4v>}rB`{hrQ1vEY=Am{5B3N>2fKy_KiHQ zo8md??3I8;DbyS0M^P{_q0NU-cXY;s4$9eeV}A zd68T~1`qhg0Pq8SUQ1zfTQi6MLiG=su&@E==!RwGi2EA-82Jnp(f{ON{Geo7pqO`n z?8nl(T~J2L3E2dyD0P=MX2$RYDAvpZAzC{lB^&{u;;j>sbNpYvhkAnOP2xn=Y z3Od`G@>mECe0-P;d}C|UyorElwrmx&k}M?vE=!qthcLzOXJd0nw=Uw)r<0VsFbdDA zbH?&&Fi#5QKqt-InMQyD(5#K{o_mktz<(M?Q=?@$h!8+6`xQkr$Z8$bHt9 zT*NM!475`jm<{`qKq~>ETG&VE(#R`ulHGC%7677p{YVtyNp`*-l?ROR5rVi2^-2wR zlzu#oB&5s_8@Mq0NsP4`*emdN$JYrMRyMAb7#&jYrh11{GmsGL^~o~=#|>E1a(}IB zgN!gwU^o&CO93w|qgZC&xl=?Pe5aIoeS5sC(EJ?s`Q+vjP##`(8iR2TB>HrE%<8zR z@1((C3G}eC-vV0g6S4lu33Z+jnvq^Rb13eofMjT@9*ctV3ROj?{G-7yue*6DS*R@- zHp+Sa-p2IW_OF6}6JBM=+opxWrfz{JPg+Eu)5o09dWPZRy^T#%42>0D)C|N?AT^(t zZ?-Etql8rS^P49_08-FXR%>1i$NicnT?c|$SZ{KRfWA7OIvAG%)~bq6j85*Ol?CX* zDx#Y{eF_6HMi=r969ySPsl?1Ja@cAb=jm(IzO0G{%g}AZ9o+9psha8f`nwK#B|gwg z#re1Mk7}&oou@Dkl)D(f=bIgYGm47ddvGm@xcV1*@h|+Wrl7&JKCl!E3lb$akQq%< zEFOxn&79INW^=Mv9?uA^01RE!;#n|3(a>cwaPsa2>4^K9BF=m1QB}jfN|GVza2I&j z0b9bl%r=Sd6}=sh_x)3Y&z*$E_lHLe(iQD2vo5hW&&b^F?cax5EM?WD?2jCjsHr>6pma69hVaY~1FLm3S}MfJi;-|iN${a8`<#!aJ9nX7OsPb+qQpHJVwiZZ|;XrO37KtNDH zN7=Z#TK;S~81O(q94tUUm_Jwl*HRSl-_ajO6GLYcRSQuQQwv)QXA3)921_S9+yD0< zz2WW\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cisco%20Firepower%20EStreamer/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco Firepower](https://www.cisco.com/site/in/en/products/security/firewalls/index.html) eStreamer Solution for Microsoft Sentinel works with [Cisco Event Streamer](https://github.com/CiscoSecurity/fp-05-microsoft-sentinel-connector) (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel \r\n eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Analytic Rules:** 3, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cisco%20Firepower%20EStreamer/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco Firepower](https://www.cisco.com/site/in/en/products/security/firewalls/index.html) eStreamer Solution for Microsoft Sentinel works with [Cisco Event Streamer](https://github.com/CiscoSecurity/fp-05-microsoft-sentinel-connector) (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel \r\n eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).\n\n This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 4, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -82,6 +82,48 @@ } ] }, + { + "name": "workbooks", + "label": "Workbooks", + "subLabel": { + "preValidation": "Configure the workbooks", + "postValidation": "Done" + }, + "bladeTitle": "Workbooks", + "elements": [ + { + "name": "workbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + } + }, + { + "name": "workbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" + } + } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "Cisco Firepower Detection and Response Quality", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Evaluates Cisco Firepower detection signal composition and drift while preserving the safety boundary between SnortML GID 411, classic signatures, and corroborated evidence." + } + } + ] + } + ] + }, { "name": "analytics", "label": "Analytics", @@ -149,6 +191,20 @@ } } ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "Cisco Firepower - SnortML signal mix drift", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects a material increase in the proportion of SnortML GID 411 events compared with the preceding seven-day baseline.\nThis is a detection-quality regression signal, not evidence that an individual event is malicious. Investigate collector,\nsensor, model, policy, and traffic changes before modifying response automation. ML-only events must not trigger automatic containment." + } + } + ] } ] }, diff --git a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json index f3f1566d2ec..610a67f77fc 100644 --- a/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json +++ b/Solutions/Cisco Firepower EStreamer/Package/mainTemplate.json @@ -27,11 +27,19 @@ "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Cisco Firepower Detection and Response Quality", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } } }, "variables": { "_solutionName": "Cisco Firepower EStreamer", - "_solutionVersion": "3.0.5", + "_solutionVersion": "3.1.0", "solutionId": "cisco.cisco-firepower-estreamer", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CiscoFirepowerEStreamer", @@ -73,6 +81,20 @@ "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('511445a6-6f4c-4e6a-a655-76c25b66597b')))]", "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','511445a6-6f4c-4e6a-a655-76c25b66597b','-', '1.0.2')))]" }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.0", + "_analyticRulecontentId4": "6ff65bb5-53bd-4ffb-a62a-25ea71c04eed", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6ff65bb5-53bd-4ffb-a62a-25ea71c04eed')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6ff65bb5-53bd-4ffb-a62a-25ea71c04eed')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6ff65bb5-53bd-4ffb-a62a-25ea71c04eed','-', '1.0.0')))]" + }, + "workbookVersion1": "1.0.0", + "workbookContentId1": "CiscoFirepowerDetectionResponseQuality", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "CiscoFirepowerConnector": "CiscoFirepowerConnector", "_CiscoFirepowerConnector": "[variables('CiscoFirepowerConnector')]", "TemplateEmptyArray": "[json('[]')]", @@ -80,7 +102,6 @@ "playbookContentId1": "CiscoFirepowerConnector", "_playbookContentId1": "[variables('playbookContentId1')]", "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-lc-',uniquestring(variables('_playbookContentId1'))))]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','lc','-', uniqueString(concat(variables('_solutionId'),'-','LogicAppsCustomConnector','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", "CiscoFirepower-BlockFQDN-NetworkGroup": "CiscoFirepower-BlockFQDN-NetworkGroup", "_CiscoFirepower-BlockFQDN-NetworkGroup": "[variables('CiscoFirepower-BlockFQDN-NetworkGroup')]", @@ -118,7 +139,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.5", + "description": "Cisco Firepower EStreamer data connector with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -499,7 +520,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Firepower EStreamer data connector with template version 3.0.5", + "description": "Cisco Firepower EStreamer data connector with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -870,7 +891,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-SnortML-GID411-MLOnly_AnalyticalRules Analytics Rule with template version 3.0.5", + "description": "CiscoFirepower-SnortML-GID411-MLOnly_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -898,10 +919,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CefAma" + ] } ], "tactics": [ @@ -914,31 +935,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -992,7 +1013,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-IDS-Signature-HighPriority_AnalyticalRules Analytics Rule with template version 3.0.5", + "description": "CiscoFirepower-IDS-Signature-HighPriority_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1020,10 +1041,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CefAma" + ] } ], "tactics": [ @@ -1036,31 +1057,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -1114,7 +1135,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-Signature-And-ML-Corroboration_AnalyticalRules Analytics Rule with template version 3.0.5", + "description": "CiscoFirepower-Signature-And-ML-Corroboration_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1142,10 +1163,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CefAma" + ] } ], "tactics": [ @@ -1158,31 +1179,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { "identifier": "FullName", "columnName": "HostCustomEntity" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SrcIpCustomEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "DstIpCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -1227,6 +1248,183 @@ "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "CiscoFirepower-Signal-Mix-Drift_AnalyticalRules Analytics Rule with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects a material increase in the proportion of SnortML GID 411 events compared with the preceding seven-day baseline.\nThis is a detection-quality regression signal, not evidence that an individual event is malicious. Investigate collector,\nsensor, model, policy, and traffic changes before modifying response automation. ML-only events must not trigger automatic containment.", + "displayName": "Cisco Firepower - SnortML signal mix drift", + "enabled": false, + "query": "let FirepowerEvents = materialize(\n CommonSecurityLog\n | where TimeGenerated >= ago(8d)\n | where DeviceVendor =~ \"Cisco\"\n | where DeviceProduct has_any (\"Firepower\", \"Secure Firewall\", \"FTD\", \"NGFW\")\n | extend Combined = strcat(tostring(Message), \" \", tostring(AdditionalExtensions), \" \", tostring(Activity), \" \", tostring(DeviceEventClassID), \" \", tostring(column_ifexists(\"FlexString1\", \"\")), \" \", tostring(column_ifexists(\"FlexString2\", \"\")), \" \", tostring(column_ifexists(\"DeviceCustomString1\", \"\")), \" \", tostring(column_ifexists(\"DeviceCustomString2\", \"\")), \" \", tostring(column_ifexists(\"DeviceCustomString3\", \"\")))\n | extend ParsedGid = toint(extract(@\"(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)\", 1, Combined))\n | extend IsMlOnly = ParsedGid == 411 or Combined has \"is_ml_only\"\n);\nlet Recent = FirepowerEvents\n | where TimeGenerated >= ago(1h)\n | summarize RecentTotal=count(), RecentMl=countif(IsMlOnly)\n | extend RecentRatio=iff(RecentTotal == 0, 0.0, todouble(RecentMl) / RecentTotal);\nlet Baseline = FirepowerEvents\n | where TimeGenerated between (ago(8d) .. ago(1d))\n | summarize BaselineTotal=count(), BaselineMl=countif(IsMlOnly)\n | extend BaselineRatio=iff(BaselineTotal == 0, 0.0, todouble(BaselineMl) / BaselineTotal);\nRecent\n| extend JoinKey=1\n| join kind=inner (Baseline | extend JoinKey=1) on JoinKey\n| where RecentTotal >= 20 and BaselineTotal >= 100\n| where RecentRatio >= 0.25 and RecentRatio >= (BaselineRatio * 2.0)\n| project TimeGenerated=now(), RecentTotal, RecentMl, RecentRatio, BaselineTotal, BaselineMl, BaselineRatio,\n DriftMultiple=round(RecentRatio / iff(BaselineRatio == 0.0, 0.0001, BaselineRatio), 2)\n", + "queryFrequency": "PT1H", + "queryPeriod": "P8D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "DefenseEvasion" + ], + "techniques": [ + "T1562" + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", + "properties": { + "description": "Cisco Firepower EStreamer Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cisco" + }, + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "contentKind": "AnalyticsRule", + "displayName": "Cisco Firepower - SnortML signal mix drift", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "CiscoFirepowerDetectionResponseQuality Workbook with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Evaluates Cisco Firepower detection signal composition and drift while preserving the safety boundary between SnortML GID 411, classic signatures, and corroborated evidence." + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Cisco Firepower detection and response quality\\nThis workbook distinguishes ML-only, classic signature, and corroborated evidence. Trends are evaluation signals—not authorization for automatic containment.\"},\"name\":\"overview\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"4a060f53-dba7-42f6-b59d-49289bedecfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let F = CommonSecurityLog\\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID),' ',tostring(column_ifexists('FlexString1','')),' ',tostring(column_ifexists('FlexString2','')),' ',tostring(column_ifexists('DeviceCustomString1','')),' ',tostring(column_ifexists('DeviceCustomString2','')),' ',tostring(column_ifexists('DeviceCustomString3','')))\\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\\\s_-]?id)[\\\\s:=]*(\\\\d+)',1,C))\\n| extend Signal=case(C has 'is_corroborated','Corroborated',Gid == 411 or C has 'is_ml_only','ML-only',isnotnull(Gid),'Signature','Unknown');\\nF | summarize Events=count(), Sources=dcount(SourceIP), Destinations=dcount(DestinationIP) by Signal | order by Events desc\",\"size\":1,\"title\":\"Signal composition\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\"},\"name\":\"signal-composition\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID))\\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\\\s_-]?id)[\\\\s:=]*(\\\\d+)',1,C))\\n| extend Signal=case(C has 'is_corroborated','Corroborated',Gid == 411 or C has 'is_ml_only','ML-only',isnotnull(Gid),'Signature','Unknown')\\n| summarize Events=count() by bin(TimeGenerated,1h), Signal\\n| order by TimeGenerated asc\",\"size\":0,\"title\":\"Signal mix over time\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"signal-trend\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID))\\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\\\s_-]?id)[\\\\s:=]*(\\\\d+)',1,C))\\n| summarize Total=count(), MlOnly=countif(Gid == 411 or C has 'is_ml_only'), Signatures=countif(isnotnull(Gid) and Gid != 411) by DeviceName\\n| extend MlRatio=round(100.0 * todouble(MlOnly) / iff(Total == 0,1,Total),2)\\n| order by MlRatio desc\",\"size\":0,\"title\":\"Sensor and collector quality\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"sensor-quality\"}],\"fallbackResourceIds\":[\"Azure Monitor\"],\"fromTemplateId\":\"sentinel-CiscoFirepowerDetectionResponseQuality\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": "@{workbookKey=CiscoFirepowerDetectionResponseQuality; logoFileName=cisco-logo-72px.svg; description=Evaluates Cisco Firepower detection signal composition and drift while preserving the safety boundary between SnortML GID 411, classic signatures, and corroborated evidence.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Cisco Firepower Detection and Response Quality; templateRelativePath=CiscoFirepowerDetectionResponseQuality.json; subtitle=Outcome-aware signal quality and drift evaluation; provider=Cisco; support=; author=; source=; categories=}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Cisco" + }, + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "CiscoFirepowerEStreamerAMA", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -1236,7 +1434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepowerConnector Playbook with template version 3.0.5", + "description": "CiscoFirepowerConnector Playbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3929,7 +4127,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.0.5", + "description": "BlockURL-CiscoFirepower-NetworkGroup Playbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -5164,7 +5362,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BlockIP-CiscoFirepower Playbook with template version 3.0.5", + "description": "BlockIP-CiscoFirepower Playbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -5308,7 +5506,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe incident did not have any entities with IPs.

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=not-required; containment=not-attempted; reason=no-ip-entity; ruleVersion=unknown; policyVersion=1.0.0
The incident did not have any entities with IPs.

" }, "host": { "connection": { @@ -5371,7 +5569,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated','signature')}; decision=approved; containment=succeeded; reason=fmc-network-group-updated; ruleVersion=unknown; policyVersion=1.0.0
The following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" }, "host": { "connection": { @@ -5559,7 +5757,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nWe could not find the Network Group object with name: '@{variables('Network Group object name')}'

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=approved; containment=failed; reason=network-group-not-found; ruleVersion=unknown; policyVersion=1.0.0
We could not find the Network Group object with name: '@{variables('Network Group object name')}'

" }, "host": { "connection": { @@ -5836,7 +6034,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Gate/Prove: ML-only - auto-contain DENIED
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" + "message": "

Gate/Prove: ML-only - auto-contain DENIED
[FirepowerOutcome:v1] signal=ml-only; decision=policy-denied; containment=not-attempted; reason=ml-only-auto-contain-denied; ruleVersion=1.0.2; policyVersion=1.0.0
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" }, "host": { "connection": { @@ -6104,7 +6302,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.0.5", + "description": "CiscoFirepower-BlockIP-Teams Playbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -6253,7 +6451,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Gate/Prove HITL warning: ML-only
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" + "message": "

Gate/Prove HITL warning: ML-only
[FirepowerOutcome:v1] signal=ml-only; decision=unknown; containment=not-attempted; reason=hitl-review-requested; ruleVersion=1.0.2; policyVersion=1.0.0
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" }, "host": { "connection": { @@ -6402,7 +6600,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe incident did not have any entities with IPs.

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=not-required; containment=not-attempted; reason=no-ip-entity; ruleVersion=unknown; policyVersion=1.0.0
The incident did not have any entities with IPs.

" }, "host": { "connection": { @@ -6787,7 +6985,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated',if(or(contains(variables('DualSignalContext'),'gid 411'),contains(variables('DualSignalContext'),'snortml'),contains(variables('DualSignalContext'),'ml-only')),'ml-only','signature'))}; decision=approved; containment=succeeded; reason=fmc-network-group-updated; ruleVersion=unknown; policyVersion=1.0.0
The following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" }, "host": { "connection": { @@ -7051,6 +7249,26 @@ "Succeeded" ] }, + "else": { + "actions": { + "Add_outcome_comment_analyst_rejected": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Cisco Firepower analyst decision
[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated',if(or(contains(variables('DualSignalContext'),'gid 411'),contains(variables('DualSignalContext'),'snortml'),contains(variables('DualSignalContext'),'ml-only')),'ml-only','signature'))}; decision=rejected; containment=not-attempted; reason=teams-action-not-submitted; ruleVersion=unknown; policyVersion=1.0.0
The analyst did not submit the containment action. Cisco Firepower was not modified.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + } + }, "expression": { "and": [ { @@ -7425,12 +7643,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.5", + "version": "3.1.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Cisco Firepower EStreamer", "publisherDisplayName": "Cisco", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco Firepower eStreamer Solution for Microsoft Sentinel works with Cisco Event Streamer (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel\neStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Analytic Rules: 3, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco Firepower eStreamer Solution for Microsoft Sentinel works with Cisco Event Streamer (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel\neStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).

\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

**NOTE: **Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 4, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -7477,6 +7695,16 @@ "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_CiscoFirepowerConnector')]", diff --git a/Solutions/Cisco Firepower EStreamer/Package/testParameters.json b/Solutions/Cisco Firepower EStreamer/Package/testParameters.json index e55ec41a9ac..1599ce461fd 100644 --- a/Solutions/Cisco Firepower EStreamer/Package/testParameters.json +++ b/Solutions/Cisco Firepower EStreamer/Package/testParameters.json @@ -20,5 +20,13 @@ "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Cisco Firepower Detection and Response Quality", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } } } diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json index 6436c691a13..671cb2f09dd 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json @@ -198,7 +198,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe incident did not have any entities with IPs.

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=not-required; containment=not-attempted; reason=no-ip-entity; ruleVersion=unknown; policyVersion=1.0.0
The incident did not have any entities with IPs.

" }, "host": { "connection": { @@ -261,7 +261,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated','signature')}; decision=approved; containment=succeeded; reason=fmc-network-group-updated; ruleVersion=unknown; policyVersion=1.0.0
The following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" }, "host": { "connection": { @@ -454,7 +454,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nWe could not find the Network Group object with name: '@{variables('Network Group object name')}'

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=approved; containment=failed; reason=network-group-not-found; ruleVersion=unknown; policyVersion=1.0.0
We could not find the Network Group object with name: '@{variables('Network Group object name')}'

" }, "host": { "connection": { @@ -734,7 +734,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Gate/Prove: ML-only - auto-contain DENIED
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" + "message": "

Gate/Prove: ML-only - auto-contain DENIED
[FirepowerOutcome:v1] signal=ml-only; decision=policy-denied; containment=not-attempted; reason=ml-only-auto-contain-denied; ruleVersion=1.0.2; policyVersion=1.0.0
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Machine-learning confidence is not equivalent to a classic signature true positive. Automatic BlockIP was not applied. Escalate for corroboration (signature or dual-signal) before containment. Do not attach this playbook to ML-only analytics.

" }, "host": { "connection": { diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md index c47a45ce331..177183a3bc5 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md @@ -6,6 +6,7 @@ This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group When a new Sentinel incident is created, this playbook gets triggered and performs below actions. 0. **Gate/Prove:** if the incident title/description indicates **ML-only** (SnortML / GID 411 / `is_ml_only`) without signature or dual-signal corroboration, the playbook comments on the incident and **cancels** - it does **not** call FMC BlockIP. Machine-learning confidence is not treated as a classic signature true positive. + The comment includes a structured `[FirepowerOutcome:v1]` policy-denial record for repeatable evaluation. 1. For the IPs we check if they are already selected for the Network Group object 2. For the IPs not already selected for the Network Group object, add it so it gets blocked 3. Comment is added to Microsoft Sentinel incident
@@ -50,4 +51,4 @@ Once deployment is complete, you will need to authorize each connection. ### b. Configurations in Sentinel 1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity. 2. Configure the automation rules to trigger this playbook -3. **Do not** attach this auto-contain playbook to ML-only analytics (SnortML GID 411). Attach it only to signature-high or signature+ML corroboration incidents. Use the Teams HITL playbook when an analyst must review an ML-only alert. \ No newline at end of file +3. **Do not** attach this auto-contain playbook to ML-only analytics (SnortML GID 411). Attach it only to signature-high or signature+ML corroboration incidents. Use the Teams HITL playbook when an analyst must review an ML-only alert. diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json index 50f1c6429fc..46ee69ec37d 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json @@ -208,7 +208,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Gate/Prove HITL warning: ML-only
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" + "message": "

Gate/Prove HITL warning: ML-only
[FirepowerOutcome:v1] signal=ml-only; decision=unknown; containment=not-attempted; reason=hitl-review-requested; ruleVersion=1.0.2; policyVersion=1.0.0
This incident matches an ML-only path (SnortML / GID 411 / is_ml_only). Do not equate ML confidence to a signature true positive. Prefer Ignore unless a classic signature or dual-signal corroboration is present. Analyst confirmation in Teams is still required before BlockIP.

" }, "host": { "connection": { @@ -362,7 +362,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe incident did not have any entities with IPs.

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=unknown; decision=not-required; containment=not-attempted; reason=no-ip-entity; ruleVersion=unknown; policyVersion=1.0.0
The incident did not have any entities with IPs.

" }, "host": { "connection": { @@ -753,7 +753,7 @@ "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Cisco Firepower playbook run summary
\nThe following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" + "message": "

Cisco Firepower playbook run summary
\n[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated',if(or(contains(variables('DualSignalContext'),'gid 411'),contains(variables('DualSignalContext'),'snortml'),contains(variables('DualSignalContext'),'ml-only')),'ml-only','signature'))}; decision=approved; containment=succeeded; reason=fmc-network-group-updated; ruleVersion=unknown; policyVersion=1.0.0
The following IPs were found in the Incident:
\n@{variables('ipAddressesActionComment')}

" }, "host": { "connection": { @@ -1024,6 +1024,27 @@ "Succeeded" ] }, + "else": { + "actions": { + "Add_outcome_comment_analyst_rejected": { + "runAfter": {}, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Cisco Firepower analyst decision
[FirepowerOutcome:v1] signal=@{if(or(contains(variables('DualSignalContext'),'is_corroborated'),contains(variables('DualSignalContext'),'dual-signal:corroborated'),contains(variables('DualSignalContext'),'signature and ml')),'corroborated',if(or(contains(variables('DualSignalContext'),'gid 411'),contains(variables('DualSignalContext'),'snortml'),contains(variables('DualSignalContext'),'ml-only')),'ml-only','signature'))}; decision=rejected; containment=not-attempted; reason=teams-action-not-submitted; ruleVersion=unknown; policyVersion=1.0.0
The analyst did not submit the containment action. Cisco Firepower was not modified.

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + } + }, "expression": { "and": [ { @@ -1280,4 +1301,4 @@ } } ] -} \ No newline at end of file +} diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md index 97b8acaebf1..73ce5b5fd5c 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md @@ -4,7 +4,7 @@ This playbook allows blocking of IPs in Cisco Firepower, using a **Network Group object**. This allows making changes to a Network Group selected members, instead of making Access List Entries. The Network Group object itself should be part of an Access List Entry. -When a new Sentinel incident is created, this playbook gets triggered and performs below actions. +When a new Sentinel incident is created, this playbook gets triggered and performs below actions. It writes a bounded `[FirepowerOutcome:v1]` record for the HITL request and final approval or rejection, making the analyst decision available for repeatable evaluation. 1. **Gate/Prove:** if the incident title/description indicates **ML-only** (SnortML / GID 411 / `is_ml_only`) without corroboration, an incident comment warns the operator. The playbook does **not** auto-block; Teams confirmation is still required. Do not treat ML confidence as a signature true positive. 2. For the IPs we check if they are already selected for the Network Group object 3. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depending on it's current status block it by adding it to the Network Group object or unblock it by removing it from the Network Group object @@ -59,4 +59,4 @@ The Teams channel to which the adaptive card will be posted will need to be conf #### c. Configurations in Sentinel 1. In Microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity. 2. Configure the automation rules to trigger this playbook -3. Prefer this HITL playbook for ML-only analytics (SnortML GID 411). Do not attach the auto-contain NetworkGroup playbook to ML-only incidents. \ No newline at end of file +3. Prefer this HITL playbook for ML-only analytics (SnortML GID 411). Do not attach the auto-contain NetworkGroup playbook to ML-only incidents. diff --git a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md index 6bc6ceff357..e470fdfcc19 100644 --- a/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md +++ b/Solutions/Cisco Firepower EStreamer/Playbooks/readme.md @@ -85,6 +85,8 @@ This integration offers 3 playbook templates that blocks IP in 3 different metho * [Cisco Firepower - Add IP Addresses to a Network Group object](./CiscoFirepower-BlockIP-NetworkGroup#deployment-instructions) - auto-contain. **Gate/Prove:** auto-contain is denied when the incident is ML-only (SnortML / GID 411). Attach only to signature-high or corroborated analytics. * [Cisco Firepower - Add IP Addresses to a Network Group object with Teams](./CiscoFirepower-BlockIP-Teams#deployment-instructions) - HITL. Warns on ML-only; analyst confirmation is still required before BlockIP. +Both BlockIP playbooks add a bounded `[FirepowerOutcome:v1]` record to their Microsoft Sentinel incident comments. The record distinguishes signal, analyst or policy decision, containment outcome, stable reason code, and policy version so decisions can be evaluated without a separate data store. See the [response outcome contract](../Evaluation/FirepowerOutcome-v1.md) for its safety invariants and deterministic evaluation cases. + diff --git a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md index c9230b4e413..76f9ac8e450 100644 --- a/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md +++ b/Solutions/Cisco Firepower EStreamer/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------| +| 3.1.0 | 27-08-2026 | Added outcome-aware response evidence, a detection and response quality workbook, SnortML signal-mix drift analytics, and a versioned deterministic evaluation contract. | | 3.0.5 | 27-08-2026 | Fixed Kusto SEM0420 in all three dual-signal Analytic Rules by replacing unsupported regex lookahead with numeric GID extraction and exact GID 411 comparison. | | 3.0.4 | 25-08-2026 | Repackaged solution (Create-Azure-Sentinel-Solution V3 tool) to pick up the 3.0.3 dual-signal Analytic Rules and Gate/Prove BlockIP changes. | | 3.0.3 | 17-08-2026 | Dual-signal Analytic Rules (SnortML GID 411 != signature TP) and Gate/Prove BlockIP (deny ML-only auto-contain; Teams HITL warning). | diff --git a/Solutions/Cisco Firepower EStreamer/Workbooks/CiscoFirepowerDetectionResponseQuality.json b/Solutions/Cisco Firepower EStreamer/Workbooks/CiscoFirepowerDetectionResponseQuality.json new file mode 100644 index 00000000000..f2c086b30e1 --- /dev/null +++ b/Solutions/Cisco Firepower EStreamer/Workbooks/CiscoFirepowerDetectionResponseQuality.json @@ -0,0 +1,85 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Cisco Firepower detection and response quality\nThis workbook distinguishes ML-only, classic signature, and corroborated evidence. Trends are evaluation signals—not authorization for automatic containment." + }, + "name": "overview" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "4a060f53-dba7-42f6-b59d-49289bedecfe", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { "durationMs": 604800000 }, + "typeSettings": { + "selectableValues": [ + { "durationMs": 86400000 }, + { "durationMs": 604800000 }, + { "durationMs": 2592000000 } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let F = CommonSecurityLog\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID),' ',tostring(column_ifexists('FlexString1','')),' ',tostring(column_ifexists('FlexString2','')),' ',tostring(column_ifexists('DeviceCustomString1','')),' ',tostring(column_ifexists('DeviceCustomString2','')),' ',tostring(column_ifexists('DeviceCustomString3','')))\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)',1,C))\n| extend Signal=case(C has 'is_corroborated','Corroborated',Gid == 411 or C has 'is_ml_only','ML-only',isnotnull(Gid),'Signature','Unknown');\nF | summarize Events=count(), Sources=dcount(SourceIP), Destinations=dcount(DestinationIP) by Signal | order by Events desc", + "size": 1, + "title": "Signal composition", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles" + }, + "name": "signal-composition" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID))\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)',1,C))\n| extend Signal=case(C has 'is_corroborated','Corroborated',Gid == 411 or C has 'is_ml_only','ML-only',isnotnull(Gid),'Signature','Unknown')\n| summarize Events=count() by bin(TimeGenerated,1h), Signal\n| order by TimeGenerated asc", + "size": 0, + "title": "Signal mix over time", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "name": "signal-trend" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Cisco' and DeviceProduct has_any ('Firepower','Secure Firewall','FTD','NGFW')\n| extend C=strcat(tostring(Message),' ',tostring(AdditionalExtensions),' ',tostring(Activity),' ',tostring(DeviceEventClassID))\n| extend Gid=toint(extract(@'(?i)(?:gid|generator[\\s_-]?id)[\\s:=]*(\\d+)',1,C))\n| summarize Total=count(), MlOnly=countif(Gid == 411 or C has 'is_ml_only'), Signatures=countif(isnotnull(Gid) and Gid != 411) by DeviceName\n| extend MlRatio=round(100.0 * todouble(MlOnly) / iff(Total == 0,1,Total),2)\n| order by MlRatio desc", + "size": 0, + "title": "Sensor and collector quality", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table" + }, + "name": "sensor-quality" + } + ], + "fallbackResourceIds": ["Azure Monitor"], + "fromTemplateId": "sentinel-CiscoFirepowerDetectionResponseQuality", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 124c93f275d..c50a8627639 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -3744,6 +3744,43 @@ ] } }, + { + "workbookKey": "CiscoFirepowerDetectionResponseQuality", + "logoFileName": "cisco-logo-72px.svg", + "description": "Evaluates Cisco Firepower detection signal composition and drift while preserving the safety boundary between SnortML GID 411, classic signatures, and corroborated evidence.", + "dataTypesDependencies": [ + "CommonSecurityLog" + ], + "dataConnectorsDependencies": [ + "CiscoFirepowerEStreamerAMA" + ], + "previewImagesFileNames": [ + "CiscoFirepowerBlack.png", + "CiscoFirepowerWhite.png" + ], + "version": "1.0.0", + "title": "Cisco Firepower Detection and Response Quality", + "templateRelativePath": "CiscoFirepowerDetectionResponseQuality.json", + "subtitle": "Outcome-aware signal quality and drift evaluation", + "provider": "Cisco", + "support": { + "name": "Cisco", + "tier": "Partner", + "link": "https://www.cisco.com/c/en_in/support/index.html" + }, + "author": { + "name": "Cisco" + }, + "source": { + "kind": "Solution", + "name": "Cisco Firepower EStreamer" + }, + "categories": { + "domains": [ + "Security - Network" + ] + } + }, { "workbookKey": "MicrosoftTeams", "logoFileName": "microsoftteams.svg",